High severity · published Aug 3, 2026
CVE-2026-69185
Socket.IO: Zero-attachment Memory Exhaustion
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
socket.io · socketio
< 3.3.6; >= 3.4.0, < 3.4.5; >= 4.0.0, < 4.2.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69185
github.com
https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
github.com
https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
github.com
https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
github.com
https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr
More from socket.io
7.5
CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
7.5
CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
7.5
CVE-2026-59724
Socket.IO: Engine.IO WebTransport SID DoS
7.5
CVE-2026-33151
socket.io allows an unbounded number of binary attachments
7.3
CVE-2024-38355
Unhandled 'error' event in socket.io