CVE-2026-59724: Socket.IO Engine.IO WebTransport DoS Vulnerability – Patch to 6.6.7

Technical summary

The vulnerability exists in Engine.IO's WebTransport upgrade handling logic. During session management, the server resolves client session IDs against the clients object without properly validating the identifier. A crafted session ID referencing prototype pollution vectors (e.g., '__proto__') bypasses the direct property check and resolves through the object's inherited prototype chain. This causes a TypeError when the upgrade handler attempts to interact with the malformed reference, crashing the server process. The issue is scoped to deployments with WebTransport explicitly enabled and affects all 6.5.x versions and 6.6.0–6.6.6.

Business impact

Services relying on Socket.IO for real-time bidirectional communication—such as collaborative platforms, live dashboards, multiplayer applications, and event-driven systems—face availability disruption. An unauthenticated attacker can repeatedly trigger crashes, producing a denial-of-service condition that affects all connected clients. Recovery requires manual restart. Organizations with critical real-time features should prioritize patching to maintain uptime and user trust.

Affected systems

Socket.IO Engine.IO versions 6.5.0 through 6.6.6 with WebTransport transport enabled are vulnerable. Deployments using only HTTP polling or standard WebSocket transports are not affected. Check your Socket.IO installation version and verify whether WebTransport is explicitly enabled in your configuration.

Exploitability

Exploitation is trivial from a network perspective. No authentication, credentials, or special privileges are required. An attacker needs only network-layer access to send a crafted WebTransport upgrade request with a malicious session ID. The attack is a simple HTTP or WebSocket message; no exploitation tools or reverse engineering are necessary. The attack can be scripted and automated, making it practical for opportunistic threat actors scanning for vulnerable instances.

Remediation

Upgrade Engine.IO to version 6.6.7 or later. If immediate patching is infeasible, disable WebTransport transport in your Socket.IO configuration and rely on WebSocket or HTTP polling until patches can be applied. Test the upgrade in a staging environment first, as Socket.IO often ships alongside application-level code that may require revalidation.

Patch guidance

Update Socket.IO to version 6.6.7 or newer. Verify the update by checking the version reported in your package metadata (npm list socket.io-engine or yarn list socket.io-engine) after installation. Test real-time functionality in your staging environment, including WebTransport connections if you re-enable it post-patch. Rolling restarts of your application servers will activate the patched code without a full outage.

Detection guidance

Monitor Engine.IO server logs for TypeErrors occurring during WebTransport upgrade operations, particularly those referencing session resolution or prototype-chain lookups. Network-level detection can flag WebTransport upgrade requests with session IDs containing suspicious patterns like '__proto__', 'constructor', or 'prototype'. Intrusion detection signatures should alert on repeated WebTransport upgrade failures from the same source. Review application performance monitoring (APM) data for sudden spikes in exception rates or process crashes correlated with WebTransport traffic.

Why prioritize this

This vulnerability merits urgent attention due to its network-exploitable nature (no authentication), straightforward attack vector, and direct impact on service availability. The CVSS 7.5 HIGH score reflects the ease of exploitation and severity of denial of service. While not enabling code execution or data compromise, the ability for any unauthenticated attacker to crash a service is operationally damaging and warrants immediate patching in production environments.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and high availability impact (A:H). The lack of confidentiality and integrity impact (C:N/I:N) reflects that the flaw is denial-of-service only. The score appropriately signals that while data confidentiality is not at risk, operational continuity is significantly threatened.

Frequently asked questions