CVE-2026-102600

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102600
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102600.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102600
Aliases
  • GHSA-wfpm-5gcm-94cg
Published
2026-09-29T15:23:15Z
Modified
2026-10-02T03:30:32Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Details

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1321",
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102600.json"
}
References

Affected packages

Git / github.com/socketio/socket.io

Affected ranges

Type
GIT
Repo
https://github.com/socketio/socket.io
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
830e3642ebb8dc3784eb749b0a004fe2b932b429
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.1.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.9.0
0.9.1
0.9.1-1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.0.0-pre
1.0.0-pre2
1.0.0-pre3
1.0.0-pre4
1.0.0-pre5
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.7.2
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.2.0
2.3.0
3.*
3.0.0
3.0.0-rc1
3.0.0-rc2
3.0.0-rc3
3.0.0-rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.1.0
3.1.1
3.1.2
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.0-alpha1
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
@socket.*
@socket.io/cluster-adapter@0.3.0
@socket.io/cluster-engine@0.1.0
@socket.io/postgres-emitter@0.1.1
@socket.io/redis-streams-emitter@0.1.0
@socket.io/redis-streams-emitter@0.1.1
engine.*
engine.io-client@6.6.1
engine.io-client@6.6.2
engine.io-client@6.6.3
engine.io-client@6.6.4
engine.io-client@6.6.5
engine.io-client@6.6.6
engine.io-parser@5.2.3
engine.io@6.6.1
engine.io@6.6.10
engine.io@6.6.2
engine.io@6.6.3
engine.io@6.6.4
engine.io@6.6.5
engine.io@6.6.6
engine.io@6.6.7
engine.io@6.6.8
engine.io@6.6.9
socket.*
socket.io-adapter@2.5.6
socket.io-adapter@2.5.7
socket.io-adapter@2.5.8
socket.io-client@4.8.0
socket.io-client@4.8.1
socket.io-client@4.8.2
socket.io-client@4.8.3
socket.io-parser@4.2.5
socket.io-parser@4.2.7
socket.io@4.7.5
socket.io@4.8.0
socket.io@4.8.1
socket.io@4.8.2
socket.io@4.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102600.json"