High severity7.5NVD Advisory· Published Mar 20, 2026· Updated Apr 14, 2026
CVE-2026-33151
CVE-2026-33151
Description
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
socket.io-parsernpm | < 3.3.5 | 3.3.5 |
socket.io-parsernpm | >= 3.4.0, < 3.4.4 | 3.4.4 |
socket.io-parsernpm | >= 4.0.0, < 4.2.6 | 4.2.6 |
Affected products
3- osv-coords2 versions
< 3.2.0-r2+ 1 more
- (no CPE)range: < 3.2.0-r2
- (no CPE)range: < 3.3.5
Patches
Vulnerability mechanics
References
6- github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4nvdPatchWEB
- github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faafnvdPatchWEB
- github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78nvdPatchWEB
- github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-677m-j7p3-52f9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33151ghsaADVISORY
News mentions
0No linked articles in our index yet.