Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-102600 · CVE overview and exploitation status

EUVD-2026-88981

GHSA-wfpm-5gcm-94cg

cve-program · CVE-2026-102600

• https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg
• https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
• https://github.com/socketio/socket.io/releases/tag/@socket.io/[email protected]

euvd · EUVD-2026-88981

• https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg
• https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
• https://github.com/socketio/socket.io/releases/tag/@socket.io/[email protected]

nvd · CVE-2026-102600

• https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
• https://github.com/socketio/socket.io/releases/tag/@socket.io/[email protected]
• https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg

osv · GHSA-wfpm-5gcm-94cg

• https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg
• https://nvd.nist.gov/vuln/detail/CVE-2026-102600
• https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
• https://github.com/socketio/socket.io
• https://github.com/socketio/socket.io/releases/tag/@socket.io/[email protected]

No related changes are available here.