{"id":"CVE-2026-69185","title":"Socket.IO enables bidirectional and low-latency communication for every platform","summary":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, w…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-20","CWE-754"],"vendor":"socket.io-parser","product":"socket.io-parser","affected":["socket.io-parser >= 4.0.0, < 4.2.7","socket.io-parser >= 3.4.0, < 3.4.5","socket.io-parser < 3.3.6"],"patched":["socket.io-parser 4.2.7","socket.io-parser 3.4.5","socket.io-parser 3.3.6"],"published":"2026-08-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:30:11.423","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69185","references":[{"url":"https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4","label":"security-advisories@github.com"},{"url":"https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240","label":"security-advisories@github.com"},{"url":"https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291","label":"security-advisories@github.com"},{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-2m8v-j782-fhvr"}],"tags":["nvd","ghsa","npm"],"epss":0.00503,"epssPercentile":0.41906,"aliases":["GHSA-2m8v-j782-fhvr"],"ecosystem":"npm","ingestedAt":"2026-08-03T19:29:00.413Z","slug":"CVE-2026-69185","body":"## Overview\n\nSocket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-69185)\n\nAffected packages:\n\n- `socket.io-parser >= 4.0.0, < 4.2.7`\n- `socket.io-parser >= 3.4.0, < 3.4.5`\n- `socket.io-parser < 3.3.6`\n\nPatched in:\n\n- `socket.io-parser 4.2.7`\n- `socket.io-parser 3.4.5`\n- `socket.io-parser 3.3.6`\n\nSource: https://github.com/advisories/GHSA-2m8v-j782-fhvr","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}