---
id: CVE-2026-69185
title: >-
  Socket.IO enables bidirectional and low-latency communication for every
  platform
summary: >-
  Socket.IO enables bidirectional and low-latency communication for every
  platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO
  packet can make the server wait for a large number of binary attachments and
  buffer them, w…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
  - CWE-754
vendor: socket.io-parser
product: socket.io-parser
affected:
  - 'socket.io-parser >= 4.0.0, < 4.2.7'
  - 'socket.io-parser >= 3.4.0, < 3.4.5'
  - socket.io-parser < 3.3.6
patched:
  - socket.io-parser 4.2.7
  - socket.io-parser 3.4.5
  - socket.io-parser 3.3.6
published: '2026-08-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:30:11.423'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69185'
references:
  - url: >-
      https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
    label: security-advisories@github.com
  - url: >-
      https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
    label: security-advisories@github.com
  - url: >-
      https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
    label: security-advisories@github.com
  - url: >-
      https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-2m8v-j782-fhvr'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.0063
epssPercentile: 0.47963
aliases:
  - GHSA-2m8v-j782-fhvr
ecosystem: npm
ingestedAt: '2026-08-03T19:29:00.413Z'
---

## Overview

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-69185)

Affected packages:

- `socket.io-parser >= 4.0.0, < 4.2.7`
- `socket.io-parser >= 3.4.0, < 3.4.5`
- `socket.io-parser < 3.3.6`

Patched in:

- `socket.io-parser 4.2.7`
- `socket.io-parser 3.4.5`
- `socket.io-parser 3.3.6`

Source: https://github.com/advisories/GHSA-2m8v-j782-fhvr