Read the docs

socketio

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high15CVSS 7.0–8.9

Exploited now

socketio records in CISA KEV

No socketio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Engine.io 6 records MEDIUM Socket.io-parser 4 records MEDIUM Socket.io 2 records LOW Engine.io-client 1 record LOW Socket.io-client Java 1 record LOW

Records

19 records

TI-2022-20281 CVE-2022-41940 · GHSA-r7qp-cfhv-p84w

Uncaught exception in engine.io

Priority MEDIUM 64

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0211 Published 2022-11-22 Partial fix · 3.6.1, 6.2.1 CWE-248
TI-2022-02236 CVE-2022-2421 · GHSA-qm95-pgcg-qqfq

Socket.io - Improper type validation in attachment parsing

Priority MEDIUM 52

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the res…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01431 Published 2022-10-25 Fixed in 4.2.1, 4.0.5 +2 CWE-89
TI-2026-25581 CVE-2026-33151 · GHSA-677m-j7p3-52f9

socket.io allows an unbounded number of binary attachments

Priority MEDIUM 44

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00535 Published 2026-03-20 Partial fix · 3.3.5, 3.4.4 +1 CWE-20
TI-2022-06052 CVE-2022-21676 · GHSA-273r-mgr4-v34f

Uncaught Exception in engine.io

Priority MEDIUM 44

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02851 Published 2022-01-12 Fixed in 4.1.2, 5.2.1 +1 CWE-754
TI-2023-15971 CVE-2023-32695 · GHSA-cqmj-92xf-r6r9

Insufficient validation when decoding a Socket.IO packet

Priority MEDIUM 41

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01059 Published 2023-05-27 Fixed in 4.2.3, 3.4.3 +1 CWE-20
TI-2026-48537 CVE-2026-69185 · GHSA-2m8v-j782-fhvr

Socket.IO: Zero-attachment Memory Exhaustion

Priority MEDIUM 40

Socket.IO enables bidirectional and low-latency communication for every platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-08-03 Partial fix · 3.3.6, 3.4.5 +1 CWE-20
TI-2026-42593 CVE-2026-59724 · GHSA-gr94-w7qr-f4j3

Socket.IO: Engine.IO WebTransport SID DoS

Priority MEDIUM 40

Socket.IO enables bidirectional and low-latency communication for every platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-07-08 Partial fix · 6.6.7 CWE-20
TI-2024-25613 CVE-2024-38355 · GHSA-25hc-qcg6-38wj

Unhandled 'error' event in socket.io

Priority MEDIUM 40

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00807 Published 2024-06-19 Partial fix · 2.5.1, 4.6.2 CWE-20
TI-2022-09431 CVE-2022-25867 · GHSA-85xx-xhjm-rhrw

NULL pointer dereference in io.socket:socket.io-client

Priority LOW 36

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01652 Published 2022-08-02 Fixed in 2.0.1 CWE-476
TI-2026-61633 CVE-2026-90651 · GHSA-jrp2-p3px-f5p5

Improper certificate validation in socketio Socket Firewall

Priority LOW 35

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00205 Published 2026-09-12 Fixed in 2.0.0 CWE-295
TI-2023-14835 CVE-2023-31125 · GHSA-q9mw-68c2-j6m5

Uncaught exception in engine.io

Priority LOW 32

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01327 Published 2023-05-08 Fixed in 6.4.2 CWE-248
TI-2020-17291 CVE-2020-28481 · GHSA-fxwf-4rqh-v8g3

Insecure Defaults

Priority LOW 25

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00745 Published 2021-01-19 Fixed in 2.4.0 CWE-346
Open these records in search →