CVE-2026-69185: Socket.IO socket.io-parser memory exhaustion via binary attachments

CVE-2026-69185 · Severity: high · CVSS 7.5 · Published 2026-08-03

Socket.IO is a popular real-time communication library used to enable bidirectional messaging between web servers and clients. An attacker can send a specially crafted binary packet with zero attachments to cause a vulnerable server to buffer and wait indefinitely for data that never arrives, exhausting server memory and causing a denial-of-service condition that impacts service availability for all users.

Vendors: Socket.IO.

Quick answers

Is CVE-2026-69185 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69185 being exploited in the wild.
How severe is CVE-2026-69185?
High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?
Socket.Io-Client >=4.0.0, <4.2.7; >=2.0.0, <3.3.6.
Is there a fix for CVE-2026-69185?
A patch was published on 2026-08-03: Patches released: socket.io-parser 4.2.7, 3.4.5, 3.3.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69185 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69185?
Check whether you run Socket.Io-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in socket.io-parser's binary packet handling logic. When a binary packet specifies an attachment count of 0 (which is technically invalid—packets without attachments should be encoded as regular EVENT or ACK packets), the parser incorrectly accepts and buffers the packet while waiting for attachments that never arrive. An unauthenticated remote attacker can exploit this over the network by sending a specially crafted Socket.IO binary packet. No authentication, user interaction, or special privileges are required. By sending multiple such packets, an attacker can exhaust server memory and trigger a denial-of-service condition. The fix rejects binary packets with zero attachments as invalid, following the protocol specification. Patches are available in socket.io-parser versions 4.2.7 (for 4.x), 3.4.5 (for 3.4.x), and 3.3.6 (for earlier versions).

Affected products

  • Socket.IO socket.io-parser >=4.0.0, <4.2.7; >=3.4.0, <3.4.5; <3.3.6
  • Socket.IO socket.io >=4.0.0, <4.2.7; >=2.0.0, <3.4.5
  • Socket.IO socket.io-client >=4.0.0, <4.2.7; >=2.0.0, <3.3.6

Identifiers

  • CVE-2026-69185
  • GHSA-2m8v-j782-fhvr

Timeline

  • 2026-08-03: disclosed: GHSA-2m8v-j782-fhvr advisory published
  • 2026-08-03: patched: Patches released: socket.io-parser 4.2.7, 3.4.5, 3.3.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.