VDB
CVE-2026-69185
CVE-2026-69185
PUBLISHED
CVSS 7.5 HIGH
Reported by GitHub_M · Published August 3, 2026
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| socketio | socket.io | < 3.3.6, >= 3.4.0, < 3.4.5, >= 4.0.0, < 4.2.7 |
| chainguard | jupyter-base-notebook | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| wolfi | jupyter-base-notebook | 0 |
| socketio | socket.io | >= 4.0.0, < 4.2.7, >= 3.4.0, < 3.4.5, < 3.3.6 |
| chainguard | tensorflow-gpu-jupyter | * |
| npm | socket.io-parser | 4.0.0, 0, 3.4.0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
Timeline
- Aug 3, 2026 CVE Published
- Aug 3, 2026 Coalition ESS Score
- Aug 4, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
References
- https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr x_refsource_CONFIRM
- https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4 x_refsource_MISC
- https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240 x_refsource_MISC
- https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-69185 advisory
- https://github.com/advisories/GHSA-2m8v-j782-fhvr advisory