CVE-2026-33151

EUVD-2026-13788
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
Affected Products (NVD)
VendorProductVersion
socketsocket.io-parser
𝑥
< 3.3.5
socketsocket.io-parser
3.4.0 ≤
𝑥
< 3.4.4
socketsocket.io-parser
4.0.0 ≤
𝑥
< 4.2.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-socket.io-parser
bookworm
no-dsa
bullseye
postponed
forky
4.2.1+~3.1.0-4
fixed
sid
4.2.1+~3.1.0-4
fixed
trixie
no-dsa
Common Weakness Enumeration
References
https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4
https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf
https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78
https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9