# CVE-2026-102599: Socket.IO Engine.IO protocol revision mismatch DoS

Source: https://junglewise.ai/threats/cve-2026-102599-socket-io-engine-io-protocol-revision-mismatch-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102599 · Severity: high · CVSS 7.5 · Published 2026-10-13

Socket.IO is a library that enables real-time communication between web clients and servers. A flaw in how Engine.IO handles transport upgrades allows an attacker to send upgrade requests with mismatched protocol versions, causing the server process to crash and become unavailable. This denial-of-service attack requires the server to support transport upgrades but no authentication from the attacker.

Technologies: [engine.io (npm)](https://junglewise.ai/threats/technologies/engine-io). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102599 being exploited in the wild.

**How severe is CVE-2026-102599?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** engine.io (npm) >= 6.6.0, < 6.6.10, SEMVER:introduced=6.6.0,fixed=6.6.10; Socket.IO contributors Engine.IO 6.6.0 to 6.6.9.

**Is there a fix for CVE-2026-102599?** Yes. engine.io (npm): upgrade to 6.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102599 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102599?** Check whether you run engine.io (npm) or Socket.IO contributors Engine.IO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- engine.io (npm): upgrade to 6.6.10 or later

  ```sh
  npm install engine.io@6.6.10
  ```


## Technical details

The vulnerability stems from Engine.IO failing to validate that an upgrade request's protocol revision (EIO parameter) matches the session's negotiated protocol. A malicious client can establish a valid Engine.IO session, then send an upgrade request (e.g., WebSocket upgrade) with an omitted or different EIO parameter, causing the server to load incompatible parser and heartbeat behavior. A crafted heartbeat packet subsequently triggers an uncaught exception, crashing the Node.js process.

## Affected products

- Socket.IO contributors Engine.IO 6.6.0 to 6.6.9

## Identifiers

- CVE-2026-102599
- GHSA-2gc4-cqfq-p2gv

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Fixed in engine.io 6.6.10

## Related threats

- [Socket.IO Engine.IO connection exhaustion in polling transport](https://junglewise.ai/threats/cve-2026-59725-socket-io-engine-io-connection-exhaustion-in-polling-transport)
- [Socket.IO Engine.IO denial of service in WebTransport upgrade handling](https://junglewise.ai/threats/cve-2026-59724-socket-io-engine-io-denial-of-service-in-webtransport-upgrade)
- [Socket.IO engine.io uncaught exception denial of service](https://junglewise.ai/threats/cve-2023-31125-socket-io-engine-io-uncaught-exception-denial-of-service)
- [Engine.IO uncaught exception denial of service](https://junglewise.ai/threats/cve-2022-41940-engine-io-uncaught-exception-denial-of-service)
- [Socket.io engine.io resource exhaustion via POST](https://junglewise.ai/threats/cve-2020-36048-socket-io-engine-io-resource-exhaustion-via-post)