CVE-2026-69185

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69185
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69185.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69185
Aliases
Downstream
Published
2026-08-03T19:09:10.073Z
Modified
2026-08-04T11:31:16.062642284Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Socket.IO: Zero-attachment Memory Exhaustion
Details

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-754"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69185.json"
}
References

Affected packages

Git / github.com/socketio/socket.io

Affected ranges

Type
GIT
Repo
https://github.com/socketio/socket.io
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
98e61b941fb9915614e0b962588817efb795020c
Fixed
e590976beb69f98faa44da7653f4ab55c5e0e61a
Introduced
5eaeffc8e2244b73dd13fd2562c9684ad289997b
Fixed
4054894738817f5a2125e6e6b18e79d92c75ab33
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.6"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.2.7"
        }
    ]
}

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.0-alpha1
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
@socket.*
@socket.io/cluster-adapter@0.3.0
@socket.io/cluster-engine@0.1.0
@socket.io/postgres-emitter@0.1.1
@socket.io/redis-streams-emitter@0.1.0
@socket.io/redis-streams-emitter@0.1.1
engine.*
engine.io-client@6.6.1
engine.io-client@6.6.2
engine.io-client@6.6.3
engine.io-client@6.6.4
engine.io-client@6.6.5
engine.io-client@6.6.6
engine.io-parser@5.2.3
engine.io@6.6.1
engine.io@6.6.2
engine.io@6.6.3
engine.io@6.6.4
engine.io@6.6.5
engine.io@6.6.6
engine.io@6.6.7
engine.io@6.6.8
engine.io@6.6.9
socket.*
socket.io-adapter@2.5.6
socket.io-adapter@2.5.7
socket.io-adapter@2.5.8
socket.io-client@4.8.0
socket.io-client@4.8.1
socket.io-client@4.8.2
socket.io-client@4.8.3
socket.io-parser@3.3.5
socket.io-parser@3.4.4
socket.io-parser@4.2.5
socket.io@4.7.5
socket.io@4.8.0
socket.io@4.8.1
socket.io@4.8.2
socket.io@4.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69185.json"