CVE-2026-59724

Published: Jul 8, 2026Modified: Jul 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

Affected (1)

Products: Socket: Engine.io

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Socket Engine.io	From 6.5.0 to 6.6.7

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c

Source: security-advisories@github.com

Patch

https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7

Source: security-advisories@github.com

Release Notes

https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3

Source: security-advisories@github.com

PatchVendor AdvisoryMitigation

Timeline

No history available yet.