CVE-2026-69185

Summary

Socket.IO: Zero-attachment Memory Exhaustion

Severity

high

CVSS

7.5

EPSS

0.6% (p50)

CWE

CWE-20, CWE-754

Also known as

GHSA-2m8v-j782-fhvr

Published

2026-08-03

Updated

2026-08-03

Advisory details

Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

Patches

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

References

• https://github.com/advisories/GHSA-2m8v-j782-fhvr
• https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr
• https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
• https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
• https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291

Related advisories

• CVE-2026-35369 — medium · crates.io/uu_kill
• GHSA-c8w6-x74f-vmg3#zebrad — medium · crates.io/zebrad
• GHSA-c8w6-x74f-vmg3#zebra-rpc — medium · crates.io/zebra-rpc
• CVE-2026-96620 — critical · PyPI/claude-agent-sdk
• CVE-2026-107726 — critical · Maven/com.hazelcast:hazelcast
• CVE-2026-77411 — critical · Go/github.com/rabbitmq/amqp091-go
• CVE-2026-75595 — critical · Maven/io.netty:netty-handler
• CVE-2026-55068 — critical · Go/github.com/free5gc/free5gc

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity