Skip to main content

Improper Input Validation

CVE-2026-69185

High
7.5/10

Summary

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to version 3.3.6, 3.4.x prior to 3.4.5 and 4.x prior to 4.2.7, a specially crafted `Socket.IO` packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published