Input validation error in socket.io-parser - CVE-2026-69185
Published: November 9, 2026
Vulnerability identifier: #VU162915
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69185
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust server memory and cause a denial of service.
The vulnerability exists due to improper validation in socket.io-parser when a specially crafted Socket.IO packet causes the server to expect a large number of binary attachments. An unauthenticated remote attacker can send the crafted packet and binary attachments to make the server buffer attachment data until memory is exhausted.
Affected software
socket.io-parser
How to mitigate CVE-2026-69185
Install security update from vendor's website.
socket.io-parser - addressed in versions 3.3.6, 3.4.5, 4.2.7