{
"id": "GHSA-2m8v-j782-fhvr",
"aliases": [
"CVE-2026-69185"
],
"details": "### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range | Used by | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `>=4.0.0 <4.2.7` | `[email protected] ` and `[email protected] ` | `4.2.7` |\n| `>=3.4.0 <3.4.5` | `[email protected] ` | `3.4.5` |\n| `<3.3.6` | `[email protected] ` | `3.3.6` |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)",
"summary": "Socket.IO: Zero-attachment Memory Exhaustion",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.2.7"
}
]
}
],
"package": {
"name": "socket.io-parser",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.5"
}
]
}
],
"package": {
"name": "socket.io-parser",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.6"
}
]
}
],
"package": {
"name": "socket.io-parser",
"ecosystem": "npm"
}
}
],
"modified": "2026-08-03T19:09:44Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2026-08-03T19:09:44Z",
"references": [
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr",
"type": "WEB"
},
{
"url": "https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4",
"type": "WEB"
},
{
"url": "https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240",
"type": "WEB"
},
{
"url": "https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291",
"type": "WEB"
},
{
"url": "https://github.com/socketio/socket.io",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-754"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-08-03T19:09:44Z"
}
}