Input validation error in socket.io-parser - CVE-2026-33151

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the Socket.IO packet parser when processing specially crafted packets with an unbounded number of binary attachments. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue can cause the server to buffer excessive binary attachments until memory is exhausted.

Affected software

How to mitigate CVE-2026-33151

External References

• https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9
• https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78

Related Security Bulletins

• Input validation error in socket.io-parser
• IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging update for Socket.IO