By vendor

Socket vulnerabilities

Known CVEs affecting Socket products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-59724HIGH 7.5

  Socket.IO's Engine.IO component versions 6.5.0 through 6.6.6 contain a denial-of-service vulnerability when WebTransport is enabled. An attacker can send a specially crafted session identifier (like '__proto__') that exploits how the server resolves inherited properties of internal objects, triggering a crash that disrupts service for all users. No authentication is required, and exploitation is straightforward from the network. Version 6.6.7 and later address this flaw.

• CVE-2026-59725HIGH 7.5

  Socket.IO's Engine.IO component, versions 4.1.0 through 6.6.6, contains a flaw in how it processes certain malformed binary requests over HTTP polling. When an attacker sends specially crafted POST requests claiming to contain binary data, the server fails to properly close the connection, leaving it in a hung state. An unauthenticated attacker on the network can repeatedly trigger this condition to accumulate open connections until the server exhausts its available resources and becomes unable to handle legitimate traffic. This is a denial-of-service vulnerability with no authentication requirement.