Read the docs
TI-2026-65444 Aliases CVE-2026-102600GHSA-wfpm-5gcm-94cg

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Priority LOW 39CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed socket.io (socketio): 0.1.1cluster-engine (@socket.io): 0.1.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
socketiosocket.iobefore 0.1.10.1.1Patch availableCNA
@socket.iocluster-enginebefore 0.1.10.1.1Patch availableCNA
—@socket.io/cluster-engine (npm)before 0.1.10.1.1Patch availableGHSA-wfpm-5gcm-94cg
  • socket.io Vendorsocketio Affected before 0.1.1 Fixed in 0.1.1 Patch available CNA
  • cluster-engine Vendor@socket.io Affected before 0.1.1 Fixed in 0.1.1 Patch available CNA
  • @socket.io/cluster-engine (npm) Vendor— Affected before 0.1.1 Fixed in 0.1.1 Patch available GHSA-wfpm-5gcm-94cg

Remediation

  • Fix · CNA socket.io (socketio) Fixed in 0.1.1
  • Fix · CNA cluster-engine (@socket.io) Fixed in 0.1.1
  • Fix · GHSA-wfpm-5gcm-94cg @socket.io/cluster-engine (npm) Fixed in 0.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102600
  2. 2026-10-06 Alias added: GHSA-wfpm-5gcm-94cg
  3. 2026-10-06 Fix available: npm/@socket.io/[email protected] · GHSA-wfpm-5gcm-94cg
  4. 2026-10-06 CVSS score added · GHSA-wfpm-5gcm-94cg
  5. 2026-10-06 Weakness changed · GHSA-wfpm-5gcm-94cg
  6. 2026-10-06 5 new references · GHSA-wfpm-5gcm-94cg

References

Advisory 1

Other 4

  • TI-2022-20281 Uncaught exception in engine.io CVSS 3.1HIGH 7.1
  • TI-2022-02236 Socket.io - Improper type validation in attachment parsing CVSS 3.1CRITICAL 10.0
  • TI-2026-25581 socket.io allows an unbounded number of binary attachments CVSS 4.0HIGH 8.7
  • TI-2022-06052 Uncaught Exception in engine.io CVSS 3.1HIGH 7.5
  • TI-2023-15971 Insufficient validation when decoding a Socket.IO packet CVSS 3.1HIGH 7.5
  • TI-2026-73305 Uncaught exception in Engine.IO lets clients crash Node.js processes CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences