Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M

CVE-2026-102599Socket.IO: Engine.IO Protocol Revision Mismatch DoS

High 7.5

In plain English

A high-severity security flaw in socket.io from socketio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	engine.io	6.6.10	GHSA-2gc4-cqfq-p2gv

Affected products (as reported)

Vendor	Product	Versions
socketio	socket.io	>= 6.6.0, < 6.6.10

Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv x_refsource_CONFIRM
https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729 x_refsource_MISC
https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.10 x_refsource_MISC