HIGH 7.5 GitHub
CVE-2026-59724
Socket.IO: Engine.IO WebTransport SID DoS
### Impact
Engine.IO servers with **WebTransport enabled** are vulnerable to a remotely triggerable denial of service.
A malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as `__proto__`. Because the session ID lookup did not properly verify that the key was an own property of the clients object, the lookup could resolve to an inherited prototype property instead of a valid Engine.IO client.
This can cause a `TypeErr
Affected Products
- npm/engine.io >= 6.5.0, < 6.6.7
References
- https://github.com/advisories/GHSA-gr94-w7qr-f4j3
- https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3
- https://nvd.nist.gov/vuln/detail/CVE-2026-59724
- https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-31 via GitHub. Affected: npm/engine.io >= 6.5.0, < 6.6.7.
vulnfeed aggregates 11540 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.