Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M

CVE-2026-102600Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

High 7.5

In plain English

A high-severity improper input validation in cluster-engine from @socket.io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 67.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@socket.io/cluster-engine	0.1.1	GHSA-wfpm-5gcm-94cg

Affected products (as reported)

Vendor	Product	Versions
socketio	socket.io	< 0.1.1
@socket.io	cluster-engine	< 0.1.1

Weakness: CWE-20, CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg x_refsource_CONFIRM
https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429 x_refsource_MISC
https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1 x_refsource_MISC