p PatchFirst

CVE-2026-69185

CVE-2026-69185 · Socket.IO: Zero-attachment Memory Exhaustion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • socket.io

    Versions
    • < 3.3.6: Affected
    • >= 3.4.0, < 3.4.5: Affected
    • >= 4.0.0, < 4.2.7: Affected

    No fix published

  • node-socket.io-parser Debian:12

    Versions
    • 4.2.1+~3.1.0-2
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    • 4.2.4+~3.1.2-1
    • 4.2.4+~3.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Debian:13

    Versions
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    • 4.2.4+~3.1.2-1
    • 4.2.4+~3.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Debian:14

    Versions
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    Affected ranges
    • ECOSYSTEM: < 4.2.4+~3.1.2-1

    Update to 4.2.4+~3.1.2-1

  • socket.io-parser npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.2.7

    Update to 4.2.7

  • socket.io-parser npm

    Affected ranges
    • SEMVER: ≥ 3.4.0, < 3.4.5

    Update to 3.4.5

  • socket.io-parser npm

    Affected ranges
    • SEMVER: < 3.3.6

    Update to 3.3.6

  • node-socket.io-parser Ubuntu:18.04:LTS

    Versions
    • 2.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:20.04:LTS

    Versions
    • 3.3.0-1
    • 3.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:22.04:LTS

    Versions
    • 4.0.2-1
    • 4.1.1+~3.0.0-1
    • 4.1.2+~3.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:24.04:LTS

    Versions
    • 4.2.1+~3.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:26.10

    Versions
    • 4.2.1+~3.1.0-4
    • 4.2.4+~3.1.2-1
    • 4.2.4+~3.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-socket.io-parser Ubuntu:26.04:LTS

    Versions
    • 4.2.1+~3.1.0-3
    • 4.2.1+~3.1.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →