---
id: CVE-2026-102600
title: >-
  Socket.IO enables bidirectional and low-latency communication for every
  platform
summary: >-
  Socket.IO enables bidirectional and low-latency communication for every
  platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object
  properties when looking up attacker-controlled session IDs in clustered
  deployments. Specia…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
  - CWE-1321
vendor: socketio
product: socket.io
affected:
  - socket.io < 0.1.1
  - cluster-engine < 0.1.1
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T17:17:06.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102600'
references:
  - url: >-
      https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
    label: security-advisories@github.com
  - url: >-
      https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-29T16:27:29.573677Z'
ingestedAt: '2026-09-29T16:39:33.263Z'
---

## Overview

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.