Socket.IO: Zero-attachment Memory Exhaustion (CVE-2026-69185)

Socket.IO: Zero-attachment Memory Exhaustion (CVE-2026-69185) | HOL Guard CVE

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps socket.io-parser (npm), socket.io-parser (npm), socket.io-parser (npm), socket.io-parser (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
socket.io-parsernpm	>=4.0.0,<4.2.7	4.2.7
socket.io-parsernpm	>=3.4.0,<3.4.5	3.4.5
socket.io-parsernpm	<3.3.6	3.3.6
socket.io-parsernpm	>=4.0.0 <4.2.7	4.2.7
socket.io-parsernpm	>=3.4.0 <3.4.5	3.4.5
socket.io-parsernpm	>=0 <3.3.6	3.3.6

Recommended response

Check inventory. Check lockfiles and deployed manifests for socket.io-parser, socket.io-parser, socket.io-parser.
Review the reported fix. Update socket.io-parser to 4.2.7; socket.io-parser to 3.4.5; socket.io-parser to 3.3.6; socket.io-parser to 4.2.7; socket.io-parser to 3.4.5; socket.io-parser to 3.3.6 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 3, 2026
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Aug 3, 2026

Sources and claim methodology

Upstream source description

### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.7` | `[email protected]` and `[email protected]` | `4.2.7` | | `>=3.4.0 <3.4.5` | `[email protected]` | `3.4.5` | | `<3.3.6` | `[email protected]` | `3.3.6` | ### Workarounds There is no known workaround except upgrading to a safe version. ### For more information If you have any questions or comments about this advisory: - Open a discussion [here](https://github.com/socketio/socket.io/discussions)

Quoted source text, attributed separately from HOL analysis.