Junglewise Threat Intelligence

CVE-2026-69185: Socket.IO socket.io-parser memory exhaustion via binary attachments

CVE-2026-69185 · Severity: high · CVSS 7.5 · Published 2026-08-03

Executive brief

Socket.IO is a popular real-time communication library used to enable bidirectional messaging between web servers and clients. An attacker can send a specially crafted binary packet with zero attachments to cause a vulnerable server to buffer and wait indefinitely for data that never arrives, exhausting server memory and causing a denial-of-service condition that impacts service availability for all users.

Technical details

The vulnerability exists in socket.io-parser's binary packet handling logic. When a binary packet specifies an attachment count of 0 (which is technically invalid—packets without attachments should be encoded as regular EVENT or ACK packets), the parser incorrectly accepts and buffers the packet while waiting for attachments that never arrive. An unauthenticated remote attacker can exploit this over the network by sending a specially crafted Socket.IO binary packet. No authentication, user interaction, or special privileges are required. By sending multiple such packets, an attacker can exhaust server memory and trigger a denial-of-service condition. The fix rejects binary packets with zero attachments as invalid, following the protocol specification. Patches are available in socket.io-parser versions 4.2.7 (for 4.x), 3.4.5 (for 3.4.x), and 3.3.6 (for earlier versions).

Affected products

  • Socket.IO socket.io-parser >=4.0.0, <4.2.7; >=3.4.0, <3.4.5; <3.3.6
  • Socket.IO socket.io >=4.0.0, <4.2.7; >=2.0.0, <3.4.5
  • Socket.IO socket.io-client >=4.0.0, <4.2.7; >=2.0.0, <3.3.6

Timeline

  • 2026-08-03: disclosed: GHSA-2m8v-j782-fhvr advisory published
  • 2026-08-03: patched: Patches released: socket.io-parser 4.2.7, 3.4.5, 3.3.6

References