CVE-2026-33151

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33151
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33151.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33151
Aliases
Downstream
Related
Published
2026-03-20T20:13:31.424Z
Modified
2026-04-10T05:42:37.359757Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
socket.io allows an unbounded number of binary attachments
Details

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33151.json",
    "cwe_ids": [
        "CWE-20",
        "CWE-754"
    ]
}
References

Affected packages

Git / github.com/socketio/socket.io

Affected ranges

Type
GIT
Repo
https://github.com/socketio/socket.io
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
719f9ebab0772ffb882bd614b387e585c1aa75d4
Type
GIT
Repo
https://github.com/socketio/socket.io
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9d39f1f080510f036782f2177fac701cc041faaf
Type
GIT
Repo
https://github.com/socketio/socket.io
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b25738c416c4e32fbff62ee182afa8f6d0dacf78

Affected versions

0.*
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.9.0
0.9.1
0.9.1-1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.0.0-pre
1.0.0-pre2
1.0.0-pre3
1.0.0-pre4
1.0.0-pre5
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.7.2
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.2.0
2.3.0
3.*
3.0.0
3.0.0-rc1
3.0.0-rc2
3.0.0-rc3
3.0.0-rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.1.0
3.1.1
3.1.2
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.0-alpha1
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
@socket.*
@socket.io/cluster-adapter@0.3.0
@socket.io/cluster-engine@0.1.0
@socket.io/postgres-emitter@0.1.1
@socket.io/redis-streams-emitter@0.1.0
@socket.io/redis-streams-emitter@0.1.1
engine.*
engine.io-client@6.6.1
engine.io-client@6.6.2
engine.io-client@6.6.3
engine.io-client@6.6.4
engine.io-parser@5.2.3
engine.io@6.6.1
engine.io@6.6.2
engine.io@6.6.3
engine.io@6.6.4
engine.io@6.6.5
engine.io@6.6.6
socket.*
socket.io-adapter@2.5.6
socket.io-client@4.8.0
socket.io-client@4.8.1
socket.io-client@4.8.2
socket.io-client@4.8.3
socket.io-parser@4.2.5
socket.io@4.7.5
socket.io@4.8.0
socket.io@4.8.1
socket.io@4.8.2
socket.io@4.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33151.json"