Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

19 records

Vendor: socketio Clear all filters
TI-2026-61633 CVE-2026-90651 · GHSA-jrp2-p3px-f5p5

Improper certificate validation in socketio Socket Firewall

Priority LOW 35

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00205 Published 2026-09-12 Fixed in 2.0.0 CWE-295
TI-2026-48537 CVE-2026-69185 · GHSA-2m8v-j782-fhvr

Socket.IO: Zero-attachment Memory Exhaustion

Priority MEDIUM 40

Socket.IO enables bidirectional and low-latency communication for every platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-08-03 Partial fix · 3.3.6, 3.4.5 +1 CWE-20
TI-2026-42593 CVE-2026-59724 · GHSA-gr94-w7qr-f4j3

Socket.IO: Engine.IO WebTransport SID DoS

Priority MEDIUM 40

Socket.IO enables bidirectional and low-latency communication for every platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-07-08 Partial fix · 6.6.7 CWE-20
TI-2026-25581 CVE-2026-33151 · GHSA-677m-j7p3-52f9

socket.io allows an unbounded number of binary attachments

Priority MEDIUM 44

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00535 Published 2026-03-20 Partial fix · 3.3.5, 3.4.4 +1 CWE-20
TI-2024-25613 CVE-2024-38355 · GHSA-25hc-qcg6-38wj

Unhandled 'error' event in socket.io

Priority MEDIUM 40

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00807 Published 2024-06-19 Partial fix · 2.5.1, 4.6.2 CWE-20
TI-2023-15971 CVE-2023-32695 · GHSA-cqmj-92xf-r6r9

Insufficient validation when decoding a Socket.IO packet

Priority MEDIUM 41

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01059 Published 2023-05-27 Fixed in 4.2.3, 3.4.3 +1 CWE-20
TI-2023-14835 CVE-2023-31125 · GHSA-q9mw-68c2-j6m5

Uncaught exception in engine.io

Priority LOW 32

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01327 Published 2023-05-08 Fixed in 6.4.2 CWE-248
TI-2022-20281 CVE-2022-41940 · GHSA-r7qp-cfhv-p84w

Uncaught exception in engine.io

Priority MEDIUM 64

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0211 Published 2022-11-22 Partial fix · 3.6.1, 6.2.1 CWE-248
TI-2022-02236 CVE-2022-2421 · GHSA-qm95-pgcg-qqfq

Socket.io - Improper type validation in attachment parsing

Priority MEDIUM 52

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the res…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01431 Published 2022-10-25 Fixed in 4.2.1, 4.0.5 +2 CWE-89
TI-2022-09431 CVE-2022-25867 · GHSA-85xx-xhjm-rhrw

NULL pointer dereference in io.socket:socket.io-client

Priority LOW 36

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01652 Published 2022-08-02 Fixed in 2.0.1 CWE-476
TI-2022-06052 CVE-2022-21676 · GHSA-273r-mgr4-v34f

Uncaught Exception in engine.io

Priority MEDIUM 44

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02851 Published 2022-01-12 Fixed in 4.1.2, 5.2.1 +1 CWE-754
TI-2020-17291 CVE-2020-28481 · GHSA-fxwf-4rqh-v8g3

Insecure Defaults

Priority LOW 25

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00745 Published 2021-01-19 Fixed in 2.4.0 CWE-346