socket.io vulnerabilities
CVEs whose affected-version data names the socket.io package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-102600High· 7.5Socket.IO enables bidirectional and low-latency communication for every platform
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Specia…
▾ Twilightsocketio · socket.ioEPSS 0.38%via NVD
CVE-2024-38355Medium· 7.3PoCsocket.io has an unhandled 'error' event
socket.io has an unhandled 'error' event
▾ Twilightsocket.io · socket.ioEPSS 0.81%via GHSA