CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion
Attackers can cause memory exhaustion and denial of service by sending crafted packets that force the server to buffer excessive binary attachments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69185?
CVE-2026-69185 is a high-severity denial of service vulnerability in socketio socket.io, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
Which versions are affected by CVE-2026-69185?
6 open source packages ship an affected version, including socket.io-parser.
| Package | Affected | Fixed in |
|---|---|---|
socket.io-parser npm | All versions | 3.3.6 |
socket.io-parser npm | All versions | 3.3.6 |
socket.io-parser npm | From 3.4.0 | 3.4.5 |
socket.io-parser npm | From 3.4.0 | 3.4.5 |
socket.io-parser npm | From 4.0.0 | 4.2.7 |
socket.io-parser npm | From 4.0.0 | 4.2.7 |
How do I fix CVE-2026-69185?
Upgrade socket.io-parser to a fixed version for your release line: 3.3.6, 3.4.5 or 4.2.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-69185 being exploited?
There is no known exploitation of CVE-2026-69185 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1788863154, CLSA-2026-1788863169, CLSA-2026-1788863171, DEBIAN-CVE-2026-69185, GHSA-2m8v-j782-fhvr, MINI-cc4j-8685-8hpg and 3 more.