CVE-2026-33151highCWE-20CWE-754

CVE-2026-33151: high-severity vulnerability in socketio socket.io

socket.io allows an unbounded number of binary attachments

Published · Updated

Follow this CVE+ Monitor socket.io+ Monitor socket.io-parser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
socketio · socket.io
Related CVEs — socketio socket.io

In the same product, most dangerous first.

CVE-2024-38355HIGHUnhandled 'error' event in socket.ioEPSS 0.8%CVE-2026-69185HIGHSocket.IO: Zero-attachment Memory ExhaustionEPSS 0.6%CVE-2026-59724HIGHSocket.IO: Engine.IO WebTransport SID DoSEPSS 0.6%CVE-2026-102599HIGHSocket.IO: Engine.IO Protocol Revision Mismatch DoSEPSS 0.6%CVE-2026-102600HIGHSocket.IO: Prototype Pollution via Unsafe Client Session LookupEPSS 0.4%