CVE-2026-69185

🗓️ 03 Aug 2026 19:09:10Reported by GitHub_MType

Zero-attachment memory exhaustion in Socket.IO from a crafted packet; fixed in 4.2.7, 3.4.5, and 3.3.6.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-69185	3 Aug 202619:09	–	attackerkb
Circl	CVE-2026-69185	3 Aug 202620:52	–	circl
Cvelist	CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	cvelist
EUVD	EUVD-2026-52410	3 Aug 202619:09	–	euvd
Github Security Blog	Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	github
NVD	CVE-2026-69185	3 Aug 202620:17	–	nvd
OSV	CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	osv
OSV	GHSA-2M8V-J782-FHVR Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	osv
Patchstack	NPM: Socket.IO: Zero-attachment Memory Exhaustion	3 Aug 202619:09	–	patchstack
Positive Technologies	PT-2026-67489	3 Aug 202600:00	–	ptsecurity

Vulners

Node

socketio socket.ioRange<3.3.6

socketio socket.ioRange3.4.0–3.4.5

socketio socket.ioRange4.0.0–4.2.7

[
  {
    "vendor": "socketio",
    "product": "socket.io",
    "versions": [
      {
        "version": "< 3.3.6",
        "status": "affected"
      },
      {
        "version": ">= 3.4.0, < 3.4.5",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.2.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
github	www.github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
github	www.github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
github	www.github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr

03 Aug 2026 21:16Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

SSVC