Fluid Attacks Database

Description

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	socket.io-parser	>=4.0.0 <4.2.7 \|\| >=3.4.0 <3.4.5 \|\| >=0 <3.3.6	4.2.7, 3.4.5, 3.3.6
debian 12	node-socket.io-parser	=4.2.1+~3.1.0-2 \|\| =4.2.1+~3.1.0-3 \|\| =4.2.1+~3.1.0-4 \|\| =4.2.4+~3.1.2-1 \|\| =4.2.4+~3.1.2-2	-
debian 13	node-socket.io-parser	=4.2.1+~3.1.0-3 \|\| =4.2.1+~3.1.0-4 \|\| =4.2.4+~3.1.2-1 \|\| =4.2.4+~3.1.2-2	-
debian 14	node-socket.io-parser	=4.2.1+~3.1.0-3 \|\| =4.2.1+~3.1.0-4 \|\| >=0 <4.2.4+~3.1.2-1	4.2.4+~3.1.2-1

Aliases

1. CVE-2026-691852. NVD-2026-691853. OSV-2026-691854. OSV-DEBIAN-2026-691855. GHSA-2m8v-j782-fhvr6. GCVE-2026-691857. SECURITY-TRACKER-CVE-2026-69185

References

1. https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr2. https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b43. https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f2404. https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.