CVE-2026-102600— Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Quick assessment
Affected
socketio socket.io
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such a
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102600
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Source: CVE Program / CVE List V5
Vulnerability Description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| socketio | socket.io | < 0.1.1 | - |
|
| @socket.io | cluster-engine | < 0.1.1 | - |
|
II. Public POCs for CVE-2026-102600
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102600
请登录查看更多情报信息。
Other References for CVE-2026-102600 (3)
-
https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: socket.io
-
CVE-2026-69185
Socket.IO: Zero-attachment Memory Exhaustion -
CVE-2026-59725
Socket.IO: Engine.IO Polling Transport Connection Exhaustion -
CVE-2026-59724
Socket.IO: Engine.IO WebTransport SID DoS -
CVE-2026-33151
socket.io allows an unbounded number of binary attachments -
CVE-2024-38355
Unhandled 'error' event in socket.io
Same vendor: socketio
-
CVE-2026-69185
Socket.IO: Zero-attachment Memory Exhaustion -
CVE-2026-59725
Socket.IO: Engine.IO Polling Transport Connection Exhaustion -
CVE-2026-59724
Socket.IO: Engine.IO WebTransport SID DoS -
CVE-2026-33151
socket.io allows an unbounded number of binary attachments -
CVE-2024-38355
Unhandled 'error' event in socket.io
Same weakness: CWE-20
-
CVE-2026-101266
Checkout validation bypass -
CVE-2026-97027
Flatpak: flatpak: denial of service via unsanitized keys in -
CVE-2026-100370
DOMSanitizer - Incomplete data: URL Sanitization in DOMSanit -
CVE-2026-13018
Chrome低于147.0.7727.55视频编码输入验证漏洞 -
CVE-2026-54710
FreePBX: Authenticated Superfecta Arbitrary PHP Code Executi
V. Comments for CVE-2026-102600
No comments yet