socket
Security Risk Profile
41
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 15 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from May 31, 2018 to present
15
Total CVEs
11
Critical+High
0
Exploited
1
Unpatched
Threat Assessment
Avg CVSS
7.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
1
Critical/High
Risk Level
41/100
medium
📈 2 in Last 30 Days
Severity Distribution
Critical
1High
10Medium
3Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
1Age Distribution
Common Weaknesses (CWE)
1
Input Validation
4
2
SQL Injection
1
3
Null Pointer Dereference
1
Most Affected Products
1. Socket Socket.io-parser Node.js11
2. npm/socket.io-parser10
3. Socket Engine.io Node.js8
4. npm/engine.io3
5. IBM Watson Knowledge Catalog on-prem2
Recent Vulnerabilities
See more →CVE-2026-59725
CVSS 7.5high
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
7/8/2026
CVE-2026-59724
CVSS 7.5high
Socket.IO: Engine.IO WebTransport SID DoS
7/8/2026🔧 No Patch
CVE-2026-33151
CVSS 8.7EPSS 0%high
socket.io allows an unbounded number of binary attachments
3/18/2026
https://www.bleepingcomputer.com/news/security/malicious-extensions-in-chrome-web-store-steal-user-credentials/
unknown
Malicious extensions in Chrome Web store steal user credentials
12/23/2025🔧 No Patch
CVE-2023-32695
CVSS 7.5high
Insufficient validation when decoding a Socket.IO packet
5/23/2023
CVE-2023-31125
CVSS 6.5medium
Uncaught exception in engine.io
5/3/2023
CVE-2022-41940
CVSS 7.1high
Uncaught exception in engine.io
11/22/2022
CVE-2022-2421
CVSS 10.0critical
Socket.io - Improper type validation in attachment parsing
10/25/2022
CVE-2022-25867
CVSS 7.5high
NULL Pointer Dereference
8/2/2022
CVE-2022-21676
CVSS 7.5high
Uncaught Exception in engine.io
1/12/2022
Monitor socket in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.