CVE-2026-59724 PUBLISHED

Socket.IO: Engine.IO WebTransport SID DoS

Assigner: GitHub_M
Reserved: 06.07.2026 Published: 08.07.2026 Updated: 08.07.2026

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as proto through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	socketio
Product	socket.io
Versions	Version >= 6.5.0, < 6.6.7 is affected

References

https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3
https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c
https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7

Problem Types

CWE-20: Improper Input Validation CWE