CVE-2026-59724: Socket.IO Engine.IO DoS Vulnerability

CVE-2026-59724 Overview

CVE-2026-59724 is a denial of service vulnerability in Socket.IO's Engine.IO server component. The flaw affects Engine.IO versions from 6.5.0 before 6.6.7 when WebTransport is enabled. Attackers can send a crafted session ID such as __proto__ during WebTransport upgrade handling. The server resolves this to an inherited property of the internal clients object, triggering a TypeError and crashing the process. The issue stems from improper input validation [CWE-20] on session identifiers used as object property lookups. Engine.IO version 6.6.7 addresses the vulnerability by replacing direct property access with Object.prototype.hasOwnProperty.call().

Critical Impact
Unauthenticated remote attackers can crash Engine.IO servers with WebTransport enabled by sending a single crafted upgrade request, resulting in a full denial of service.

Affected Products

Socket.IO Engine.IO server versions 6.5.0 through 6.6.6
Node.js applications using Engine.IO with WebTransport enabled
Socket.IO deployments built on the affected Engine.IO versions

Discovery Timeline

2026-07-08 - CVE-2026-59724 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59724

Vulnerability Analysis

Engine.IO maintains a clients object that maps session IDs to active client instances. During a WebTransport upgrade, the server looks up the incoming session ID as a property on this object. The lookup does not distinguish between own properties and inherited ones from Object.prototype. Attackers can supply reserved JavaScript property names such as __proto__, constructor, or toString as the session ID. The lookup returns a prototype method or the prototype itself rather than a client instance. Subsequent code paths that expect a client object then invoke methods on the wrong value and throw a TypeError, terminating the Node.js process.

Root Cause

The root cause is improper input validation [CWE-20] combined with unsafe property access on a plain JavaScript object. Engine.IO used direct bracket notation such as clients[sid] without verifying that the key existed as an own property. JavaScript's prototype chain exposes properties like __proto__ on every plain object, allowing attacker-controlled input to reach unintended values.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker initiates a WebTransport upgrade to a vulnerable Engine.IO server and supplies __proto__ as the session identifier. No prior session establishment or credentials are required. A single request crashes the server process, and repeated requests prevent recovery after restarts.

typescript

   } catch (e) {}
 }
 
+// Object.hasOwn() was introduced in Node.js 16.9
+function hasOwn(obj: Record<string, any>, key: string): boolean {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
 export abstract class BaseServer extends EventEmitter {
   public opts: ServerOptions;

Source: Socket.IO Security Patch Commit. The patch introduces a hasOwn helper that uses Object.prototype.hasOwnProperty.call() to verify session IDs are own properties before dereferencing them, blocking prototype-chain lookups.

Detection Methods for CVE-2026-59724

Indicators of Compromise

WebTransport upgrade requests containing session IDs equal to __proto__, constructor, toString, hasOwnProperty, or other Object.prototype member names.
Unexpected TypeError exceptions originating from Engine.IO server code paths during WebTransport upgrade handling.
Repeated Node.js process crashes or restart loops on services exposing Socket.IO endpoints with WebTransport enabled.

Detection Strategies

Inspect HTTP and WebTransport traffic for sid query parameters or path segments matching reserved JavaScript property names.
Correlate application crash logs with recent WebTransport upgrade attempts to identify triggering requests.
Monitor Engine.IO version strings in dependency manifests and lockfiles to flag installations below 6.6.7.

Monitoring Recommendations

Enable structured logging for Engine.IO upgrade events and record client-supplied session IDs for post-incident analysis.
Alert on abnormal rates of Node.js process restarts under process managers such as PM2, systemd, or Kubernetes.
Deploy a Web Application Firewall rule that blocks requests where the sid parameter matches known prototype property names.

How to Mitigate CVE-2026-59724

Immediate Actions Required

Upgrade Engine.IO to version 6.6.7 or later across all Node.js services using Socket.IO.
Audit application configuration and disable WebTransport support on servers that do not require it until patching is complete.
Review dependency trees for transitive installations of vulnerable Engine.IO versions bundled with Socket.IO.

Patch Information

The fix is available in Engine.IO 6.6.7, published as engine.io@6.6.7 Release Notes. The corresponding advisory is GHSA-gr94-w7qr-f4j3. The patch introduces the hasOwn helper in packages/engine.io/lib/server.ts to validate session ID lookups.

Workarounds

Disable the WebTransport transport in Engine.IO server options if patching cannot be performed immediately.
Front the Socket.IO endpoint with a reverse proxy that rejects requests containing reserved property names in the sid parameter.
Restrict inbound WebTransport traffic to trusted client networks using firewall or ingress controller rules.

bash

# Update Engine.IO to the patched version
npm install engine.io@6.6.7

# Verify the installed version
npm ls engine.io

# Temporary mitigation: disable WebTransport in Engine.IO server options
# const io = new Server({ transports: ["polling", "websocket"] });