EUVD-2026-42312Published

Socket.IO: Engine.IO WebTransport SID DoS

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-59724

Published

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

Source published: 8 Jul 2026 15:35:39 UTC
Source modified: 8 Jul 2026 19:41:18 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-42312

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jul 8, 2026, 3:35:39 PM

dateUpdated: Jul 8, 2026, 7:41:18 PM

1 related source bulletins · separate from aliases

RHSA-2026:26994: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-45491 · CVE-2026-45591 · CVE-2026-45736 · CVE-2026-59724 · CVE-2026-59868 · CVE-2026-59870

Source published: Jul 8, 2026, 3:35:39 PM (timezone not stated)
Source modified: Jul 8, 2026, 7:41:18 PM (timezone not stated)
Observed here: 7 Nov 2026 13:25:13 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2026-59724

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-20 · NVD-CWE-noinfo

Original publisher date fields

published: 2026-07-08T16:16:32.980

lastModified: 2026-10-25T20:10:00.147

1 source CPE criteria · context only

cpe:2.3:a:socket:engine.io:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 8 Jul 2026 16:16:32 UTC
Source modified: 25 Oct 2026 20:10:00 UTC
Observed here: 27 Oct 2026 15:15:33 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-gr94-w7qr-f4j3

Published

### Impact Engine.IO servers with **WebTransport enabled** are vulnerable to a remotely triggerable denial of service. A malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as `__proto__`. Because the session ID lookup did not properly verify that the key was an own property of the clients object, the lookup could resolve to an inherited prototype property instead of a valid Engine.IO client. This can cause a `TypeError` during WebTransport upgrade handling. Since the failure occurs in an asynchronous context, it may result in an unhandled Promise rejection and terminate the Node.js process on affected Node.js versions/configurations. Successful exploitation can allow an unauthenticated remote attacker to crash the server process and cause denial of service. Under a process supervisor, repeated exploitation may cause crash loops. Affected configurations are limited to deployments where WebTransport support is enabled. WebTransport is not enabled by default. Affected versions: - `engine.io >= 6.5.0 < 6.6.7` ## Patches The issue was fixed in: - **engine.io 6.6.7** Users should upgrade to `[email protected]` or later. If using Socket.IO packages that depend on Engine.IO, users should update to a Socket.IO release that includes the patched Engine.IO version. ### Workarounds If upgrading immediately is not possible, affected users can mitigate the issue by disabling WebTransport support. WebTransport is opt-in, so servers should ensure that `webtransport` is not included in the enabled transports list. For example, use only the default HTTP long-polling and WebSocket transports: ```js const engine = new Server({ transports: ["polling", "websocket"], }); ``` Additional operational mitigations may include: - Restricting access to WebTransport endpoints at the reverse proxy or HTTP/3 layer. - Disabling HTTP/3/WebTransport support until the patched version can be deployed. - Running the service under a supervisor as a partial availability mitigation, though this does not prevent repeated crash attempts. ### References - Fix commit: https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c - Engine.IO changelog entry for `6.6.7`: https://github.com/socketio/socket.io/blob/main/packages/engine.io/CHANGELOG.md#667-2026-04-27 - Engine.IO package: https://www.npmjs.com/package/engine.io - Socket.IO repository: https://github.com/socketio/socket.io

Source published: 31 Aug 2026 21:28:12 UTC
Source modified: 31 Aug 2026 21:45:08 UTC
Observed here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH