CVE-2026-33151 socket.io allows an unbounded number of binary attachments
Attackers can cause server memory exhaustion by sending crafted packets with excessive binary attachments, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33151?
CVE-2026-33151 is a high-severity denial of service vulnerability in socketio socket.io, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
Which versions are affected by CVE-2026-33151?
6 open source packages ship an affected version, including socket.io-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
socket.io-parser npm | All versions | 3.3.5 |
socket.io-parser npm | All versions | 3.3.5 |
socket.io-parser npm | From 3.4.0 | 3.4.4 |
socket.io-parser npm | From 3.4.0 | 3.4.4 |
socket.io-parser npm | From 4.0.0 | 4.2.6 |
socket.io-parser npm | From 4.0.0 | 4.2.6 |
Products include Socket Socket.io-Parser.
How do I fix CVE-2026-33151?
Upgrade socket.io-parser to a fixed version for your release line: 3.3.5, 3.4.4 or 4.2.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33151 being exploited?
There is no known exploitation of CVE-2026-33151 in the wild and no public exploit code.
Other vulnerabilities in socketio socket.io
Sources
Also known as CLSA-2026-1779324474, CLSA-2026-1779324475, CLSA-2026-1779324477, CLSA-2026-1784769501, DEBIAN-CVE-2026-33151, GHSA-677m-j7p3-52f9 and 2 more.