← Vulnerability feed

Vulnerability record · CVE-2020-36049 · published 8 January 2021

CVE-2020-36049: Socket.io-parser allocation without limits vulnerability

Socket · Socket.Io Parser

socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

7.5 CVSS 3.1 High EPSS 2.6% · top 15.0% CWE-770 · Allocation without limits
7.5CVSS 3.1 base score, v2 5.0
2.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.caller.xyz/socketio-engineio-dos/ ExploitThird Party Advisory
https://github.com/bcaller/kill-engine-io Third Party Advisory
https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55 PatchThird Party Advisory
https://blog.caller.xyz/socketio-engineio-dos/ ExploitThird Party Advisory
https://github.com/bcaller/kill-engine-io Third Party Advisory
https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55 PatchThird Party Advisory

Track CVE-2020-36049 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-2421Socket.io-parser sql injection vulnerabilityDue to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an a…EPSS 1.2%8.7CVE-2026-33151Socket.io-parser improper input validation vulnerabilitySocket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially c…EPSS 0.63%7.5CVE-2023-32695Socket.io-parser improper input validation vulnerabilitysocket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.…EPSS 1.1%8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2020-36049), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.