Is CVE-2026-102599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102599 being exploited in the wild.

How severe is CVE-2026-102599?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

engine.io (npm) >= 6.6.0, < 6.6.10, SEMVER:introduced=6.6.0,fixed=6.6.10; Socket.IO contributors Engine.IO 6.6.0 to 6.6.9.

Is there a fix for CVE-2026-102599?

Yes. engine.io (npm): upgrade to 6.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102599 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102599?

Check whether you run engine.io (npm) or Socket.IO contributors Engine.IO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102599: Socket.IO Engine.IO protocol revision mismatch DoS

Q: Is there a fix for CVE-2026-102599?

Yes. engine.io (npm): upgrade to 6.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102599 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102599?

Check whether you run engine.io (npm) or Socket.IO contributors Engine.IO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102599 · Severity: high · CVSS 7.5 · Published 2026-10-13

Socket.IO is a library that enables real-time communication between web clients and servers. A flaw in how Engine.IO handles transport upgrades allows an attacker to send upgrade requests with mismatched protocol versions, causing the server process to crash and become unavailable. This denial-of-service attack requires the server to support transport upgrades but no authentication from the attacker.

Technologies: engine.io (npm). Vendors: npm.

Quick answers

Is CVE-2026-102599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102599 being exploited in the wild.
How severe is CVE-2026-102599?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: engine.io (npm) >= 6.6.0, < 6.6.10, SEMVER:introduced=6.6.0,fixed=6.6.10; Socket.IO contributors Engine.IO 6.6.0 to 6.6.9.
Is there a fix for CVE-2026-102599?: Yes. engine.io (npm): upgrade to 6.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102599 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102599?: Check whether you run engine.io (npm) or Socket.IO contributors Engine.IO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

engine.io (npm): upgrade to 6.6.10 or later
```
npm install engine.io@6.6.10
```

Technical details

The vulnerability stems from Engine.IO failing to validate that an upgrade request's protocol revision (EIO parameter) matches the session's negotiated protocol. A malicious client can establish a valid Engine.IO session, then send an upgrade request (e.g., WebSocket upgrade) with an omitted or different EIO parameter, causing the server to load incompatible parser and heartbeat behavior. A crafted heartbeat packet subsequently triggers an uncaught exception, crashing the Node.js process.

Affected products

Socket.IO contributors Engine.IO 6.6.0 to 6.6.9

Identifiers

CVE-2026-102599
GHSA-2gc4-cqfq-p2gv

Timeline

2026-09-29: disclosed
2026-09-29: patched: Fixed in engine.io 6.6.10

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.