Answer in brief
CVE-2026-33151 records a Unknown severity vulnerability in socket.io allows an unbounded number of binary attachments. The current sources do not mark it as known exploited. The current feed maps socket.io-parser (npm), socket.io-parser (npm), socket.io-parser (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps socket.io-parser (npm), socket.io-parser (npm), socket.io-parser (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| socket.io-parsernpm | >=0 <3.3.5 | 3.3.5 |
| socket.io-parsernpm | >=3.4.0 <3.4.4 | 3.4.4 |
| socket.io-parsernpm | >=4.0.0 <4.2.6 | 4.2.6 |
Published upstream
Mar 18, 2026
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.6` | `[email protected]` and `[email protected]` | `4.2.6` | | `>=3.4.0 <3.4.4` | `[email protected]` | `3.4.4` | | `<3.3.5` | `[email protected]` | `3.3.5` | ### Workarounds There is no known workaround except upgrading to a safe version. ### For more information If you have any questions or comments about this advisory: - Open a discussion [here](https://github.com/socketio/socket.io/discussions)
Quoted source text, attributed separately from HOL analysis.