CVE-2026-69185

🗓️ 03 Aug 2026 19:09:10Reported by GitHub_MType

Zero-attachment memory exhaustion in Socket.IO from a crafted packet; fixed in 4.2.7, 3.4.5, and 3.3.6.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: Vulnerability in socket.io-parser bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.	2 Oct 202616:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	14 Sep 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses third party libraries which is vulnerable to multiple cves.	1 Oct 202610:46	–	ibm
attackerkb	CVE-2026-69185	3 Aug 202619:09	–	attackerkb
Chainguard	CVE-2026-69185 vulnerabilities	17 Aug 202620:31	–	cgr
Circl	CVE-2026-69185	3 Aug 202620:52	–	circl
Cvelist	CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	cvelist
Debian CVE	CVE-2026-69185	3 Aug 202619:09	–	debiancve
EUVD	EUVD-2026-52410	3 Aug 202619:09	–	euvd
Github Security Blog	Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	github

Vulners

Node

socket socket.ioRange<3.3.6

socket socket.ioRange3.4.0–3.4.5

socket socket.ioRange4.0.0–4.2.7

[
  {
    "vendor": "socketio",
    "product": "socket.io",
    "versions": [
      {
        "version": "< 3.3.6",
        "status": "affected"
      },
      {
        "version": ">= 3.4.0, < 3.4.5",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.2.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
github	www.github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
github	www.github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
github	www.github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr

10 Sep 2026 20:30Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

EPSS0.0063

SSVC