CVE-2026-69185

🗓️ 03 Aug 2026 19:09:10Reported by GitHub_MType

Zero-attachment memory exhaustion in Socket.IO from a crafted packet; fixed in 4.2.7, 3.4.5, and 3.3.6.

Reporter	Title	Published	Views	Family All 39
ATTACKERKB	CVE-2026-69185	3 Aug 202619:09	–	attackerkb
Chainguard	CVE-2026-69185 vulnerabilities	17 Aug 202620:31	–	cgr
Circl	CVE-2026-69185	3 Aug 202620:52	–	circl
Cvelist	CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	cvelist
Debian CVE	CVE-2026-69185	3 Aug 202619:09	–	debiancve
EUVD	EUVD-2026-52410	3 Aug 202619:09	–	euvd
Github Security Blog	Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	github
NVD	CVE-2026-69185	3 Aug 202620:17	–	nvd
OSV	CGA-9674-3PG5-QF6C	4 Aug 202613:51	–	osv
OSV	CGA-977X-GQMP-6PWH	4 Aug 202613:13	–	osv

Vulners

Node

socket socket.ioRange<3.3.6

socket socket.ioRange3.4.0–3.4.5

socket socket.ioRange4.0.0–4.2.7

[
  {
    "vendor": "socketio",
    "product": "socket.io",
    "versions": [
      {
        "version": "< 3.3.6",
        "status": "affected"
      },
      {
        "version": ">= 3.4.0, < 3.4.5",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.2.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
github	www.github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
github	www.github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
github	www.github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr

10 Sep 2026 20:30Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.00503

SSVC