{"id":"EUVD-2026-100462","enisaUuid":"0cbb330f-8810-30a1-a068-9d9248e34fcf","description":"Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.","datePublished":"Oct 13, 2026, 7:05:10 PM","dateUpdated":"Oct 17, 2026, 12:39:46 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv\nhttps://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729\nhttps://github.com/socketio/socket.io/releases/tag/engine.io@6.6.10\n","aliases":"CVE-2026-102599\nGHSA-2gc4-cqfq-p2gv\n","assigner":"GitHub_M","epss":0.58,"enisaIdProduct":[{"id":"d449e6b3-c95e-352b-8874-c8fa02006d26","product":{"name":"socket.io","vendor":{"name":"socketio"}},"product_version":"6.6.0, \u003c 6.6.10"}],"enisaIdVendor":[{"id":"1570c4be-29d6-3aab-aedf-ac7e2f12d2c4","vendor":{"name":"socketio"}}],"enisaIdVulnerability":[{"id":"6730e778-0b18-389d-abe3-55f42fc8be36","vulnerability":{"id":"CVE-2026-102599","description":"Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.","datePublished":"Oct 13, 2026, 7:05:10 PM","dateUpdated":"Oct 17, 2026, 12:39:46 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv\nhttps://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729\nhttps://github.com/socketio/socket.io/releases/tag/engine.io@6.6.10\n","enisa_id":"EUVD-2026-100462\n","assigner":"GitHub_M","epss":0.58,"dataProcessed":"Nov 1, 2026, 4:03:30 AM","vulnerabilityProduct":[{"id":"a0d84e6e-a8b5-33c5-a262-d7a7ff8978f2","product":{"name":"socket.io","vendor":{"name":"socketio"}},"product_version":"6.6.0, \u003c 6.6.10"}],"vulnerabilityVendor":[{"id":"6881c2e0-66f2-377c-98ea-96e25ab2f728","vendor":{"name":"socketio"}}]}},{"id":"d27a56cc-fdfb-3b19-afa8-4465ba91b5af","vulnerability":{"id":"GHSA-2gc4-cqfq-p2gv","description":"Socket.IO: Engine.IO Protocol Revision Mismatch DoS","datePublished":"Sep 29, 2026, 11:44:33 PM","dateUpdated":"Sep 29, 2026, 11:44:33 PM","baseScore":0.0,"references":"https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv\nhttps://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729\nhttps://github.com/socketio/socket.io\nhttps://github.com/socketio/socket.io/releases/tag/engine.io@6.6.10\n","enisa_id":"EUVD-2026-100462\n","aliases":"GHSA-2gc4-cqfq-p2gv\nCVE-2026-102599\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}