CVE-2026-102599

HIGH 7.5

Socket.IO: Engine.IO Protocol Revision Mismatch DoS

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.

CWE	CWE-248
Vendor	socketio
Product	socket.io
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for socketio socket.io

Be the first to know when new high vulnerabilities affecting socketio socket.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

socketio / socket.io

>= 6.6.0, < 6.6.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv github.com: https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729 github.com: https://github.com/socketio/socket.io/releases/tag/[email protected]