GHSA-WFPM-5GCM-94CG Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

EUVD-2026-88981

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup...

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such a...

Prototype Pollution

Overview @socket.io/cluster-engine is an A cluster-friendly engine to share load between multiple Node.js processes without sticky sessions Affected versions of this package are vulnerable to Prototype Pollution via client lookup in engine.ts, where session IDs supplied in inter-process messages...

CVE-2026-102600

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600

The @socket.io/cluster-engine component in Socket.IO is vulnerable to a Prototype Pollution flaw prior to version 0.1.1 . The root cause is the use of inherited object properties during the lookup of attacker-controlled session IDs in clustered deployments. By using special property names like __...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

PT-2026-102635

Name of the Vulnerable Software and Affected Versions @socket.io/cluster-engine versions prior to 0.1.1 Description In clustered deployments, the software uses inherited object properties when looking up session IDs controlled by an attacker. By using special property names like proto or...

CVE-2026-102600: Improper Input Validation

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

[SECURITY] Fedora 45 Update: corosync-3.1.10-8.fc45

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

[SECURITY] Fedora 43 Update: corosync-3.1.10-3.fc43

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

[SECURITY] Fedora 44 Update: corosync-3.1.10-6.fc44

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

Corosync Cluster Engine DoS

The vulnerability of the Corosync cluster engine is related to incorrect checking of the return value of a function. Exploiting this vulnerability could allow an attacker to cause service failures...

Corosync Cluster Engine Integer Overflow DoS

The vulnerability of the Corosync cluster engine is related to a numerical overflow condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

Corosync Cluster Engine Heap Buffer Overflow DoS

The vulnerability of the coroparse.c component of the Corosync cluster engine is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

Corosync Cluster Engine Heap Buffer Overflow DoS

The vulnerability of the coroparse.c component of the Corosync cluster engine is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...