CVE Feed

    Dashboard / CVE / CVE-2026-102599

    CVE-2026-102599

    Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.

    Published:Oct 13, 2026
    Last Modified:Oct 19, 2026
    EPS:Oct 13, 2026
    EPSS Score:0.00583
    CVSS Score:7.5

    Affected Products

    Vendor
    Socket
    Product
    Socket.io

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-248 Uncaught Exception

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-102600 (CVSS 7.5) — Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/c…
    CVE-2026-69185 (CVSS 7.5) — Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3…
    CVE-2026-59725 (CVSS 7.5) — Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Eng…
    CVE-2026-59724 (CVSS 7.5) — Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Eng…
    CVE-2026-33151 (CVSS 8.7) — Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions…
    CVE-2020-28481 (CVSS 5.3) — The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domai…
    CVE-2017-16031 (CVSS 7.5) — Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-102599 — Socket (High 7.5) | CVE-DB