ROOT-APP-NPM-CVE-2026-33151 CVE-2026-33151 in socket.io-parser - Patched by Root

Root has patched CVE-2026-33151 in the socket.io-parser package for Root:npm. Multiple fixed versions available...

CLSA-2026-1779324474 TuxCare security update for socket.io-parser (2 CVEs)

TuxCare rebuilt socket.io-parser to address 2 CVEs. Fixed in 3.4.3-tuxcare.1...

CLSA-2026-1776731787 TuxCare security update for socket.io-parser (5 CVEs)

TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 3.1.3-tuxcare.1...

CLSA-2026-1772496675 TuxCare security update for socket.io-parser (16 CVEs)

TuxCare rebuilt socket.io-parser to address 16 CVEs. Fixed in 3.2.0-tuxcare.1...

Improper Check for Unusual or Exceptional Conditions

Overview socket.io-parser is a socket.io protocol parser Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted packets that make th...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2647 more potentially affected by CVE-2026-69185 via socket.io-parser (>=4.0.1-rc1, <=4.2.6)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-69185 Source advisory: OSV:GHSA-2M8V-J782-FHVR...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1127 more potentially affected by CVE-2026-69185 via socket.io-parser (>=3.1.1, <=3.3.5)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-69185 Source advisory: OSV:GHSA-2M8V-J782-FHVR...

NPM: Socket.IO: Zero-attachment Memory Exhaustion

NPM: Socket.IO: Zero-attachment Memory Exhaustion vulnerability discovered by ? in WordPress Npm socket.io-parser versions 3.3.6...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2647 more potentially affected by CVE-2026-69185 via socket.io-parser (>=4.0.1-rc1, <=4.2.6)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-69185 Source advisory: SNYK:JS-SOCKETIOPARSER-18517008...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1127 more potentially affected by CVE-2026-69185 via socket.io-parser (>=3.1.1, <=3.3.5)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-69185 Source advisory: SNYK:JS-SOCKETIOPARSER-18517008...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:socket.io-parser is a socket.io protocol parser Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses socket.io-parser-4.2.4 in inspections app which is vulnerable to CVE-2026-33151

Summary IBM Maximo Application Suite - Manage Component uses socket.io-parser-4.2.4 in inspections app which is vulnerable to CVE-2026-33151 Vulnerability Details CVEID:CVE-2026-33151 DESCRIPTION: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior t...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-33151 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-33151 Source...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +1927 more potentially affected by CVE-2026-33151 via socket.io-parser (>=4.0.1-rc1, <=4.2.5)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-33151 Source advisory: OSV:GHSA-677M-J7P3-52F9...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1126 more potentially affected by CVE-2026-33151 via socket.io-parser (>=3.1.1, <=3.3.4)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-33151 Source advisory: OSV:GHSA-677M-J7P3-52F9...

org.webjars.npm:browser-sync-ui (2.27.11), org.webjars.npm:nestjs__platform-socket.io (9.0.0-next.2) +3 more potentially affected by CVE-2026-33151 via org.webjars.npm:socket.io-parser (>=2.3.1, <=4.2.5)

org.webjars.npm:socket.io-parser MAVEN version =2.3.1, =0.3.1, =0.5.0 - org.webjars.npm:socket.io-client 4.8.3 Source cves: CVE-2026-33151 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15680279...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +1927 more potentially affected by CVE-2026-33151 via socket.io-parser (>=4.0.1-rc1, <=4.2.5)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-33151 Source advisory: SNYK:JS-SOCKETIOPARSER-15680278...

Allocation of Resources Without Limits or Throttling

Overview socket.io-parser is a socket.io protocol parser Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Decoder class, which accepts an unlimited number of binary attachments. An attacker can exploit this to exhaust server memory...