Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59725Socket.IO: Engine.IO Polling Transport Connection Exhaustion

High 7.5

In plain English

A high-severity security flaw in engine.io from socketio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	engine.io	6.6.7	GHSA-r635-g3xr-vw7x

Affected products (as reported)

Vendor	Product	Versions
socketio	engine.io	>= 4.1.0, < 6.6.7

Weakness: CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x x_refsource_CONFIRM
https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671 x_refsource_MISC
https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7 x_refsource_MISC