← Vulnerability feed

Vulnerability record · CVE-2026-59725 · published 8 July 2026

CVE-2026-59725: Socket engine.io improper resource shutdown vulnerability

Socket · Engine.Io

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

7.5 CVSS 3.1 High EPSS 0.64% · top 51.6% CWE-404 · Improper resource shutdown
7.5CVSS 3.1 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
13 Jul 2026Last modified by NVD

Description

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671 Patch
https://github.com/socketio/socket.io/releases/tag/[email protected] Release Notes
https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x PatchVendor Advisory

Track CVE-2026-59725 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-59724Socket engine.io improper input validation vulnerabilitySocket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enable…EPSS 0.61%7.5CVE-2022-21676Socket engine.io vulnerabilityEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted H…EPSS 2.8%7.5CVE-2020-36048Socket engine.io uncontrolled resource consumption vulnerabilityEngine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.EPSS 3.2%6.5CVE-2023-31125Socket engine.io vulnerabilityEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception…EPSS 1.3%6.5CVE-2022-41940Socket engine.io vulnerabilityEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted H…EPSS 2.1%7.8CVE-2018-8639Windows Win32k memory handling flaw allows privilege elevationThe Win32k component in Windows fails to properly handle objects in memory, creating an elevation of privilege vulnerability. It affects a broad rang…KEVEPSS 22%analysed7.8CVE-2018-8611Windows Kernel Memory Handling Elevation of PrivilegeThe Windows kernel fails to properly handle objects in memory, allowing a local attacker to elevate privileges. The flaw affects a broad set of Windo…KEVEPSS 4.2%analysed7.8CVE-2018-8406Microsoft DirectX Graphics Kernel driver elevation of privilegeThe DirectX Graphics Kernel (DXGKRNL) driver mishandles objects in memory, allowing a local attacker to elevate privileges. It affects Windows 10, Wi…KEVEPSS 3.4%analysed

Source: NIST National Vulnerability Database (record CVE-2026-59725), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.