CVE-2026-33151: socket.io allows an unbounded number of binary attachments
Impact
A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
Patches
| Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | >=4.0.0 <4.2.6 | socket.io@4.x and socket.io-client@4.x | 4.2.6 | | >=3.4.0 <3.4.4 | socket.io@2.x | 3.4.4 | | <3.3.5 | socket.io-client@2.x | 3.3.5 |
Workarounds
There is no known workaround except upgrading to a safe version.
For more information
If you have any questions or comments about this advisory:
- Open a discussion here
Other sources
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/socket.io-parserto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
npm/socket.io-parserto a version that resolves this vulnerability.Fixed in 3.4.4 - Upgrade
Upgrade
npm/socket.io-parserto a version that resolves this vulnerability.Fixed in 3.3.5 - Upgrade
Upgrade
socket.io/socket.ioto a version that resolves this vulnerability.Fixed in 3.3.5 - Upgrade
Upgrade
socket.io/socket.ioto a version that resolves this vulnerability.Fixed in 3.4.4 - Upgrade
Upgrade
socket.io/socket.ioto a version that resolves this vulnerability.Fixed in 4.2.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33151?
CVE-2026-33151 has a high severity rating due to its potential to exhaust server memory.
How do I fix CVE-2026-33151?
You can fix CVE-2026-33151 by upgrading to socket.io-parser version 4.2.6, 3.4.4, or 3.3.5.
What is the impact of CVE-2026-33151?
CVE-2026-33151 allows attackers to exploit the server by sending large amounts of binary attachments, leading to memory exhaustion.
Which versions are affected by CVE-2026-33151?
Versions of socket.io-parser from 4.0.0 to 4.2.6, 3.4.0 to 3.4.4, and below 3.3.5 are affected by CVE-2026-33151.
Is CVE-2026-33151 patch available?
Yes, patches for CVE-2026-33151 have been released in the specified fixed versions of socket.io-parser.