Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can mak…

A denial-of-service vulnerability exists in Socket.IO, a real-time bidirectional communication library. Affected versions prior to 4.2.7, 3.4.5, and 3.3.6 are vulnerable to memory exhaustion attacks. An attacker can send a specially crafted packet that causes the server to buffer a large number of binary attachments, eventually exhausting server memory. This vulnerability can be exploited remotely without authentication, making it a significant risk for any service using affected Socket.IO versions. The issue has been patched in versions 4.2.7, 3.4.5, and 3.3.6. Multiple commits were issued across different version branches to address the vulnerability. Users are strongly advised to upgrade to the fixed versions immediately. The vulnerability is tracked under CVE-2026-69185 and also documented in GitHub Security Advisory GHSA-2m8v-j782-fhvr.