CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion
An unauthenticated attacker can exhaust server connections by sending invalid binary POST requests, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59725?
CVE-2026-59725 is a high-severity denial of service vulnerability in socketio engine.io, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.
Weakness: CWE-404
Which versions are affected by CVE-2026-59725?
2 open source packages ship an affected version, including engine.io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
engine.io npm | From 4.1.0 | 6.6.7 |
engine.io npm | From 4.1.0 | 6.6.7 |
Linux distribution packages (5)
dotnet-sdk-8.0 Red Hat:hummingbird:1 | All versions | 0:8.0.129-2.hum1 |
dotnet-sdk-8.0-source-built-artifacts Red Hat:hummingbird:1 | All versions | 0:8.0.129-2.hum1 |
dotnet-sdk-dbg-8.0 Red Hat:hummingbird:1 | All versions | 0:8.0.129-2.hum1 |
dotnet-templates-8.0 Red Hat:hummingbird:1 | All versions | 0:8.0.129-2.hum1 |
dotnet8.0 Red Hat:hummingbird:1 | All versions | 0:8.0.129-2.hum1 |
Products include Socket Engine.io.
How do I fix CVE-2026-59725?
Upgrade engine.io to 6.6.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59725 being exploited?
There is no known exploitation of CVE-2026-59725 in the wild and no public exploit code.
Other vulnerabilities in socketio engine.io
Sources
Also known as CLSA-2026-1792617714, GHSA-r635-g3xr-vw7x, MINI-53xc-4g7r-8phh, MINI-fpwc-2vr2-pg7r, RHSA-2026:42986, ROOT-APP-NPM-CVE-2026-59725.