GHSA-WFPM-5GCM-94CG Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

EUVD-2026-88981

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup...

Prototype Pollution

Overview @socket.io/cluster-engine is an A cluster-friendly engine to share load between multiple Node.js processes without sticky sessions Affected versions of this package are vulnerable to Prototype Pollution via client lookup in engine.ts, where session IDs supplied in inter-process messages...

CVE-2026-102600

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600

The @socket.io/cluster-engine component in Socket.IO is vulnerable to a Prototype Pollution flaw prior to version 0.1.1 . The root cause is the use of inherited object properties during the lookup of attacker-controlled session IDs in clustered deployments. By using special property names like __...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

PT-2026-102635

Name of the Vulnerable Software and Affected Versions @socket.io/cluster-engine versions prior to 0.1.1 Description In clustered deployments, the software uses inherited object properties when looking up session IDs controlled by an attacker. By using special property names like proto or...

CVE-2026-102600: Improper Input Validation

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...