CVE-2026-33151: Socket.IO DoS Vulnerability

CVE-2026-33151 Overview

Socket.IO, an open source real-time bidirectional event-based communication framework, contains a critical memory exhaustion vulnerability that allows remote attackers to cause denial of service conditions. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them in memory, which can be exploited to make the server run out of memory and crash.

Critical Impact
Remote unauthenticated attackers can exhaust server memory by sending malicious packets with excessive binary attachment claims, leading to service unavailability without any user interaction required.

Affected Products

Socket.IO versions prior to 3.3.5
Socket.IO versions prior to 3.4.4
Socket.IO versions prior to 4.2.6

Discovery Timeline

2026-03-20 - CVE-2026-33151 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33151

Vulnerability Analysis

This vulnerability exists in the Socket.IO parser's handling of binary attachments. The parser component is responsible for decoding incoming Socket.IO packets, including those containing binary data. When a packet declares binary attachments, the decoder allocates memory to buffer these attachments while waiting for the complete data to arrive.

The core issue stems from improper input validation (CWE-20) in the Decoder class, which did not enforce any limit on the number of binary attachments a client could claim to be sending. An attacker could send a malicious packet header claiming an extremely large number of binary attachments, causing the server to allocate unbounded memory resources waiting for data that may never arrive or arrives slowly.

This vulnerability is exploitable over the network without authentication, making it particularly dangerous for public-facing Socket.IO servers. The attack requires no user interaction and can be executed by any client capable of establishing a Socket.IO connection.

Root Cause

The root cause is the absence of a maximum limit on binary attachments in the Socket.IO parser's Decoder class. Before the patch, the decoder would accept any number of declared binary attachments without validation, allocating memory buffers for each one. This design flaw allows attackers to specify arbitrarily large attachment counts, forcing the server to allocate excessive memory.

Attack Vector

The attack is network-based and requires no authentication or special privileges. An attacker connects to a Socket.IO server and sends crafted packets that declare a large number of binary attachments. The server's parser begins buffering in anticipation of receiving these attachments, consuming memory proportional to the claimed attachment count. By sending multiple such requests or claiming extremely high attachment counts, an attacker can exhaust available server memory, causing the application to crash or become unresponsive.

javascript

// Security patch in index.js - fix(parser): add a limit to the number of binary attachments
// Before: Decoder accepted unlimited attachments
-function Decoder() {
+function Decoder(opts) {
   this.reconstructor = null;
+  opts = opts || {};
+  this.opts = {
+    maxAttachments: opts.maxAttachments || 10,
+  };
 }

Source: GitHub Commit Fix

The TypeScript implementation adds comprehensive options handling:

typescript

// Security patch in packages/socket.io-parser/lib/index.ts
type JSONReviver = (this: any, key: string, value: any) => any;

export interface DecoderOptions {
  /**
   * Custom reviver to pass down to JSON.parse()
   */
  reviver?: JSONReviver;
  /**
   * Maximum number of binary attachments per packet
   * @default 10
   */
  maxAttachments?: number;
}

export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
  private reconstructor: BinaryReconstructor;
  private opts: Required<DecoderOptions>;

Source: GitHub Commit Improvement

Detection Methods for CVE-2026-33151

Indicators of Compromise

Unusual memory consumption spikes on servers running Socket.IO applications
Socket.IO connections declaring abnormally high numbers of binary attachments
Server crashes or out-of-memory errors in Node.js processes running Socket.IO
Incomplete Socket.IO packets with binary attachment counts exceeding normal application behavior

Detection Strategies

Monitor Node.js process memory usage for abnormal growth patterns during Socket.IO activity
Implement application-level logging to track the number of binary attachments per connection
Deploy network intrusion detection rules to identify Socket.IO packets with excessive attachment declarations
Set up alerting thresholds for memory utilization on servers hosting Socket.IO services

Monitoring Recommendations

Configure memory usage alerts at 70-80% threshold for early warning of potential exploitation
Enable detailed Socket.IO debug logging to capture packet metadata including attachment counts
Implement connection rate limiting to slow potential denial of service attacks
Monitor for patterns of connections that claim binary attachments but never complete transmission

How to Mitigate CVE-2026-33151

Immediate Actions Required

Update Socket.IO to patched versions: 3.3.5, 3.4.4, or 4.2.6 or later immediately
Review and restart all applications using vulnerable Socket.IO versions
Implement memory limits on Node.js processes using --max-old-space-size flag
Consider deploying rate limiting at the network or application layer

Patch Information

This vulnerability has been patched in Socket.IO versions 3.3.5, 3.4.4, and 4.2.6. The fix introduces a maxAttachments configuration option that defaults to 10 attachments per packet. Organizations should update to these versions or later. For detailed patch information, refer to the GitHub Security Advisory GHSA-677m.

Workarounds

If immediate patching is not possible, implement a reverse proxy or middleware to inspect and limit Socket.IO packet attachment counts
Deploy memory monitoring with automatic process restart capabilities using tools like PM2
Consider temporarily restricting Socket.IO access to trusted networks or authenticated users only
Implement connection limits per IP address to reduce the impact of single-source attacks

bash

# Configuration example - Update Socket.IO to patched version
npm update socket.io@4.2.6

# Alternative: Specify exact version in package.json
npm install socket.io@4.2.6 --save

# Set Node.js memory limits as additional protection
node --max-old-space-size=512 server.js