CVE-2026-69185High· 7.5▾ TwilightSocket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.6%
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
socket.io-parser >= 4.0.0, < 4.2.7socket.io-parser >= 3.4.0, < 3.4.5socket.io-parser < 3.3.6Patched in:
socket.io-parser 4.2.7socket.io-parser 3.4.5socket.io-parser 3.3.6Source: https://github.com/advisories/GHSA-2m8v-j782-fhvr
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-57936Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to 13 SGEs for now
CVE-2024-56624High· 7.8In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix out_fput in iommufd_fault_alloc() As fput() calls the file->f_op->release op, where fault obj and ictx are getting released, there is no need to release t…
CVE-2021-4454High· 7.5In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is …
CVE-2024-46865Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first
CVE-2019-19126Low· 3.3On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possib…
CVE-2020-13631Medium· 5.5SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.