CVE-2026-59724: Socket.IO: Engine.IO WebTransport SID DoS
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as proto through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Socket.IO (Engine.IO WebTransport)to a version that resolves this vulnerability.Fixed in 6.6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59724?
The severity of CVE-2026-59724 is rated high, with a CVSS score of 7.5.
How do I fix CVE-2026-59724?
To fix CVE-2026-59724, upgrade Socket.IO Engine.IO to version 6.6.7 or later.
What type of attack does CVE-2026-59724 facilitate?
CVE-2026-59724 facilitates a denial of service (DoS) attack due to improper session ID handling.
Which versions of Socket.IO are affected by CVE-2026-59724?
CVE-2026-59724 affects Socket.IO Engine.IO versions from 6.5.0 to before 6.6.7.
What component of Socket.IO does CVE-2026-59724 impact?
CVE-2026-59724 impacts the Engine.IO component of Socket.IO when WebTransport is enabled.