4 matches found
CVE-2026-102600
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
CVE-2026-102600
The @socket.io/cluster-engine component in Socket.IO is vulnerable to a Prototype Pollution flaw prior to version 0.1.1 . The root cause is the use of inherited object properties during the lookup of attacker-controlled session IDs in clustered deployments. By using special property names like __...
EUVD-2026-88981
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...