CVE-2026-102600

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1
https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg

Configurations

No configuration.

History

29 Sep 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-29 16:17

Updated : 2026-09-30 19:38

NVD link : CVE-2026-102600

Mitre link : CVE-2026-102600

CVE.ORG link : CVE-2026-102600

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-102600", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102600", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T16:27:29.573677Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "socketio", "product": "socket.io", "versions": [{"status": "affected", "version": "< 0.1.1"}]}, {"vendor": "@socket.io", "product": "cluster-engine", "versions": [{"status": "affected", "version": "< 0.1.1"}]}]}], "published": "2026-09-29T16:17:06.180", "references": [{"url": "https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429", "source": "security-advisories@github.com"}, {"url": "https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1."}], "lastModified": "2026-09-30T19:38:27.293", "sourceIdentifier": "security-advisories@github.com"}