Executive brief
A vulnerability in the Engine.IO library (used by Socket.IO for real-time communication) allows an unauthenticated attacker to crash or slow down a server. By sending specially crafted network requests, an attacker can force the server to keep connections open indefinitely, eventually exhausting its resources. This can prevent legitimate users from accessing the service, leading to a total denial of service.
Technical details
A denial of service vulnerability exists in engine.io due to improper resource shutdown (CWE-404) in the polling transport code path. An unauthenticated remote attacker can trigger this by opening an Engine.IO protocol v4 polling session and sending a malformed binary POST request with 'Content-Type: application/octet-stream'. While the server identifies a transport error, it fails to close the associated HTTP response, causing the underlying socket and file descriptors to remain open. Repeated exploitation leads to resource exhaustion, preventing new connections. The issue is fixed in version 6.6.7.
Affected products
- Socket.IO engine.io >= 4.1.0, < 6.6.7
Timeline
- 2026-06-25: disclosed: Initial disclosure on GitHub
- 2026-07-08: advisory: NVD publication date
- 2026-07-20: advisory: GitHub Advisory reviewed and updated