# CVE-2026-59725: Socket.IO Engine.IO connection exhaustion in polling transport

Source: https://junglewise.ai/threats/cve-2026-59725-socket-io-engine-io-connection-exhaustion-in-polling-transport  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-59725 · Severity: high · CVSS 7.5 · Published 2026-07-08

A vulnerability in the Engine.IO library (used by Socket.IO for real-time communication) allows an unauthenticated attacker to crash or slow down a server. By sending specially crafted network requests, an attacker can force the server to keep connections open indefinitely, eventually exhausting its resources. This can prevent legitimate users from accessing the service, leading to a total denial of service.

Technologies: [engine.io (npm)](https://junglewise.ai/threats/technologies/engine-io). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-59725 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59725 being exploited in the wild.

**How severe is CVE-2026-59725?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** engine.io (npm) >= 4.1.0, < 6.6.7, SEMVER:introduced=4.1.0,fixed=6.6.7.

**Is there a fix for CVE-2026-59725?** Yes. engine.io (npm): upgrade to 6.6.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59725 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59725?** Check whether you run engine.io (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- engine.io (npm): upgrade to 6.6.7 or later

  ```sh
  npm install engine.io@6.6.7
  ```


## Technical details

A denial of service vulnerability exists in engine.io due to improper resource shutdown (CWE-404) in the polling transport code path. An unauthenticated remote attacker can trigger this by opening an Engine.IO protocol v4 polling session and sending a malformed binary POST request with 'Content-Type: application/octet-stream'. While the server identifies a transport error, it fails to close the associated HTTP response, causing the underlying socket and file descriptors to remain open. Repeated exploitation leads to resource exhaustion, preventing new connections. The issue is fixed in version 6.6.7.

## Affected products

- Socket.IO engine.io >= 4.1.0, < 6.6.7

## Identifiers

- CVE-2026-59725
- GHSA-r635-g3xr-vw7x

## Timeline

- 2026-06-25: disclosed: Initial disclosure on GitHub
- 2026-07-08: advisory: NVD publication date
- 2026-07-20: advisory: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/hibrian827](https://api.github.com/users/hibrian827)
- [https://github.com/hibrian827](https://github.com/hibrian827)
- [https://api.github.com/users/hibrian827/gists%7B/gist_id%7D](https://api.github.com/users/hibrian827/gists%7B/gist_id%7D)
- [https://api.github.com/users/hibrian827/repos](https://api.github.com/users/hibrian827/repos)
- [https://avatars.githubusercontent.com/u/48850892?v=4](https://avatars.githubusercontent.com/u/48850892?v=4)
- [https://api.github.com/users/hibrian827/events%7B/privacy%7D](https://api.github.com/users/hibrian827/events%7B/privacy%7D)

## Related threats

- [Socket.IO Engine.IO protocol revision mismatch DoS](https://junglewise.ai/threats/cve-2026-102599-socket-io-engine-io-protocol-revision-mismatch-dos)
- [Socket.IO Engine.IO denial of service in WebTransport upgrade handling](https://junglewise.ai/threats/cve-2026-59724-socket-io-engine-io-denial-of-service-in-webtransport-upgrade)
- [Socket.IO engine.io uncaught exception denial of service](https://junglewise.ai/threats/cve-2023-31125-socket-io-engine-io-uncaught-exception-denial-of-service)
- [Engine.IO uncaught exception denial of service](https://junglewise.ai/threats/cve-2022-41940-engine-io-uncaught-exception-denial-of-service)
- [Socket.io engine.io resource exhaustion via POST](https://junglewise.ai/threats/cve-2020-36048-socket-io-engine-io-resource-exhaustion-via-post)