CVE-2026-59725: Socket.IO Engine.IO HTTP Polling Denial of Service

Technical summary

The Engine.IO protocol v4 polling transport implementation in Socket.IO versions 4.1.0 through 6.6.6 does not correctly handle HTTP response closure when processing invalid binary POST requests with Content-Type: application/octet-stream headers. The affected code path fails to terminate the HTTP response object, leaving the underlying socket connection in an open state even when the request is rejected. An attacker can exploit this by sending a series of invalid binary POST requests to a target Socket.IO polling endpoint without authentication. Each malformed request consumes a server-side socket resource that is never released, eventually exhausting the server's connection pool and preventing legitimate users from connecting. The vulnerability is rooted in improper resource cleanup (CWE-404: Improper Resource Validation) and is addressed in Engine.IO version 6.6.7 and later.

Business impact

Organizations running vulnerable Socket.IO instances face availability risk. An attacker with network access can launch a resource exhaustion attack that degrades or completely denies service to legitimate users. Since the attack requires no authentication and can be executed remotely, the barrier to exploitation is low. Applications that depend on real-time bidirectional communication—such as collaborative tools, live dashboards, chat systems, and gaming platforms—will experience service interruption. Recovery typically requires manual server restart or connection timeout, leading to downtime and potential data loss in session-dependent workflows.

Affected systems

Socket.IO's Engine.IO component versions 4.1.0 through 6.6.6 are vulnerable. Any application or service using these versions with HTTP polling transport enabled is at risk. Engine.IO is a foundational library used by Socket.IO and is often bundled with Node.js applications. Both direct dependencies and transitive dependencies should be reviewed. Applications exclusively using WebSocket transport (without polling fallback) may have reduced but not eliminated exposure, as the vulnerability is specific to the polling transport handler.

Exploitability

Exploitation is straightforward and requires no special privileges or authentication. An attacker needs only network access to the target Socket.IO endpoint and the ability to send HTTP POST requests with malformed binary Content-Type headers. The attack can be automated easily and scaled to multiple targets. No user interaction or browser-based attack is necessary. The CVSS score of 7.5 (High) reflects the ease of exploitation (AV:N/AC:L/PR:N/UI:N) combined with significant availability impact. While the attack does not compromise confidentiality or integrity, the reliable availability impact and low attack complexity make it a material threat.

Remediation

Upgrade Socket.IO's Engine.IO component to version 6.6.7 or later immediately. This patched version corrects the HTTP response closure logic for invalid binary requests, ensuring connections are properly terminated. Organizations should verify their dependency tree, as Engine.IO may be pulled in transitively. After patching, perform application restart and confirm that polling endpoints respond correctly. No configuration changes are required post-patch. For organizations unable to upgrade immediately, temporarily disabling HTTP polling transport and relying solely on WebSocket may reduce exposure, though this is a workaround and not a permanent fix.

Patch guidance

Verify your Engine.IO version: check package.json or package-lock.json for the exact installed version. Update to 6.6.7 or later using your package manager (npm update engine.io or equivalent). Test the patched version in a staging environment before production deployment to confirm application compatibility and that polling transport functions correctly. Review and update any locked dependency constraints that may prevent upgrading. After patching production, monitor connection metrics and response times to confirm the vulnerability is resolved and no regressions were introduced.

Detection guidance

Monitor for accumulation of CLOSE_WAIT or TIME_WAIT socket states on servers running Socket.IO, which can indicate uncleared connections. Log and alert on repeated HTTP POST requests to polling endpoints with Content-Type: application/octet-stream headers followed by connection drops. Inspect firewall and load-balancer logs for traffic spikes from single sources sending repeated malformed requests to Socket.IO endpoints. Use netstat, ss, or similar tools to track open connection counts; a steady rise in connections without corresponding closures is suspicious. Application-level monitoring should track active polling connections and alert on unexpected growth in the connection pool.

Why prioritize this

This vulnerability warrants immediate patching priority. The combination of high CVSS score (7.5), trivial exploitability (no authentication, low attack complexity), and direct denial-of-service impact makes it attractive to opportunistic attackers. The widespread use of Socket.IO in real-time applications and the simplicity of triggering the flaw mean that patch deployment should begin within days, not weeks. Organizations should treat this as a high-priority security maintenance item.

Risk score, explained

The CVSS 3.1 score of 7.5 is assigned HIGH severity based on: (1) Network vector (AV:N)—the vulnerability is remotely exploitable with no special network access required; (2) Low attack complexity (AC:L)—no special conditions or timing are needed to trigger the flaw; (3) No privileges required (PR:N)—authentication is unnecessary; (4) No user interaction (UI:N)—the attack is fully automated; (5) Scope unchanged (S:U)—impact is limited to the vulnerable component; (6) No confidentiality impact (C:N) and no integrity impact (I:N)—data is neither disclosed nor modified; (7) High availability impact (A:H)—the service becomes unavailable through resource exhaustion. The score reflects a readily exploitable denial-of-service condition with significant operational impact.

Frequently asked questions