p PatchFirst

CVE-2026-33151

CVE-2026-33151 · socket.io allows an unbounded number of binary attachments

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • socket.io

    Versions
    • < 3.3.5: Affected
    • >= 3.4.0, < 3.4.4: Affected
    • >= 4.0.0, < 4.2.6: Affected

    No fix published

  • node-socket.io-parser Debian:12

    Versions
    • 4.2.1+~3.1.0-2
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    • 4.2.4+~3.1.2-1
    • 4.2.4+~3.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Debian:13

    Versions
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    • 4.2.4+~3.1.2-1
    • 4.2.4+~3.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Debian:14

    Versions
    • 4.2.1+~3.1.0-3
    Affected ranges
    • ECOSYSTEM: < 4.2.1+~3.1.0-4

    Update to 4.2.1+~3.1.0-4

  • socket.io-parser npm

    Affected ranges
    • SEMVER: < 3.3.5

    Update to 3.3.5

  • socket.io-parser npm

    Affected ranges
    • SEMVER: ≥ 3.4.0, < 3.4.4

    Update to 3.4.4

  • socket.io-parser npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.2.6

    Update to 4.2.6

  • node-socket.io-parser Ubuntu:18.04:LTS

    Versions
    • 2.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:20.04:LTS

    Versions
    • 3.3.0-1
    • 3.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:22.04:LTS

    Versions
    • 4.0.2-1
    • 4.1.1+~3.0.0-1
    • 4.1.2+~3.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:24.04:LTS

    Versions
    • 4.2.1+~3.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:25.10

    Versions
    • 4.2.1+~3.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:26.04:LTS

    Versions
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →