Vulnerability Description
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Socket | Engine.Io | >= 4.1.0, < 6.6.7 |
Related Weaknesses (CWE)
References
- https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355fPatch
- https://github.com/socketio/socket.io/releases/tag/[email protected]Release Notes
- https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7xPatchVendor Advisory
FAQ
What is CVE-2026-59725?
CVE-2026-59725 is a vulnerability with a CVSS score of 7.5 (HIGH). Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid...
How severe is CVE-2026-59725?
CVE-2026-59725 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59725?
Check the references section above for vendor advisories and patch information. Affected products include: Socket Engine.Io.