CVE-2026-33151: socket.io-parser Vulnerability Allows Unbounded Binary Attachments
Summary
CVE-2026-33151: socket.io allows an unbounded number of binary attachments. Affects socket.io-parser versions < 3.3.5, 3.4.4, 4.2.6. Fixed in 3.3.5, 3.4.4, 4.2.6. How to fix ↓
Also tracked for
- socket.io-parser · npm
The same CVE-2026-33151 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
socket.io-parser is a critical component of the Socket.IO library, which facilitates real-time, bidirectional communication between web clients and servers. It is widely used in applications requiring instant messaging and live updates. The library's ability to handle binary data is essential for performance, but it also introduces risks if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2026-33151 allows a specially crafted Socket.IO packet to cause the server to wait for an unbounded number of binary attachments. This can lead to excessive memory consumption, potentially causing the server to run out of memory and crash. The issue arises from inadequate validation of incoming packets, making it possible for attackers to exploit this flaw by sending maliciously constructed packets.
How To Fix
Minimum fixed version
3.3.5, 3.4.4, 4.2.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than upgrading to a safe version of the package. It is strongly recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-33151 vulnerability in socket.io-parser poses a significant risk to applications using this library. It is essential to update to the latest patched versions to protect against potential memory exhaustion attacks. Regular monitoring and updates are vital for maintaining application security.
See every vulnerability recorded for socket.io-parser →
FAQ
CVE-2026-33151 is a vulnerability in the socket.io-parser package that allows an attacker to exploit the server's handling of binary attachments, potentially leading to memory exhaustion.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can cause the server to run out of memory, leading to crashes and service interruptions, affecting the availability of your application.
Yes, the vulnerability has been fixed in versions 3.3.5, 3.4.4, and 4.2.6 of the socket.io-parser package. It is recommended to update to these versions.
There are no effective workarounds available. It is crucial to prioritize upgrading to a patched version to ensure the security of your application.
Related vulnerabilities
Recent vulnerabilities recorded for socket.io-parser.
