CVE-2026-33151 socket.io allows an unbounded number of binary attachments

🗓️ 20 Mar 2026 20:13:31Reported by GitHub_MType

CVE-2026-33151: Socket.IO can buffer unlimited binary attachments, risking memory exhaustion.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to loss of confidentiality, denial of service and cross-site scripting	6 May 202613:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in socket.io-parser bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging	13 Jul 202621:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses socket.io-parser-4.2.4 in inspections app which is vulnerable to CVE-2026-33151	1 May 202612:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities impacting watsonx.data integration	30 Jul 202617:36	–	ibm
ATTACKERKB	CVE-2026-33151	20 Mar 202620:13	–	attackerkb
BDU FSTEC	The vulnerability of the socket.io parser library’s encoder and decoder allows a attacker to induce a service failure.	8 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33151 vulnerabilities	20 Mar 202601:17	–	cgr
Circl	CVE-2026-33151	20 Mar 202622:49	–	circl

[
  {
    "vendor": "socketio",
    "product": "socket.io",
    "versions": [
      {
        "version": "< 3.3.5",
        "status": "affected"
      },
      {
        "version": ">= 3.4.0, < 3.4.4",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.2.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4
github	www.github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78
github	www.github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9
github	www.github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf

20 Mar 2026 20:13Current

CVSS 48.7

EPSS0.00514

socket io memory exhaustion unbounded attachments patched versions 3.3.5 patched versions 3.4.4 patched versions 4.2.6