CVE-2026-59725: Socket.IO DoS Vulnerability

CVE-2026-59725 Overview

CVE-2026-59725 is a resource management vulnerability in Socket.IO's Engine.IO component. The flaw affects the Engine.IO protocol v4 polling transport, which fails to properly close HTTP responses for invalid binary POST requests carrying a Content-Type: application/octet-stream header. An unauthenticated remote attacker can send malformed requests repeatedly to exhaust server-side connections and sockets, leading to denial of service. The issue affects versions from 4.1.0 up to but not including 6.6.7 and is categorized under [CWE-404] Improper Resource Shutdown or Release. Socket.IO is widely used in real-time web applications for bidirectional client-server communication, making this vulnerability relevant to any Node.js service exposing Engine.IO polling endpoints.

Critical Impact
Unauthenticated remote attackers can exhaust server connections and sockets, causing denial of service on any Socket.IO application using Engine.IO v4 polling transport.

Affected Products

Socket.IO engine.io versions from 4.1.0 up to (but not including) 6.6.7
Applications using Engine.IO protocol v4 polling transport
Node.js services exposing Socket.IO endpoints over HTTP

Discovery Timeline

2026-07-08 - CVE-2026-59725 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59725

Vulnerability Analysis

The vulnerability resides in the Engine.IO polling transport handler within the Socket.IO project. When a client sends a POST request with Content-Type: application/octet-stream under Engine.IO protocol v4, the server validates the request and identifies it as invalid binary content. The code path invokes this.onError("invalid content") and returns, but never sends an HTTP response back to the client. The underlying HTTP request and its associated socket remain open until they eventually time out. An unauthenticated attacker can send a high volume of these malformed POST requests to accumulate open sockets on the server, consuming file descriptors and connection slots until legitimate clients cannot connect.

Root Cause

The root cause is improper resource shutdown [CWE-404]. The error branch in the polling transport calls onError for logging and internal state updates but omits writing an HTTP response, so the connection is never terminated by the server. Node.js keeps the socket in the open state waiting for a response that never arrives.

Attack Vector

The attack requires network access to the Socket.IO endpoint and no authentication or user interaction. An attacker crafts POST requests to the Engine.IO polling URL with Content-Type: application/octet-stream and repeats them concurrently to drain available socket resources.

typescript

// Security patch in packages/engine.io/lib/transports/polling.ts
// fix(eio): close HTTP requests with invalid content type
     const isBinary = "application/octet-stream" === req.headers["content-type"];
 
     if (isBinary && this.protocol === 4) {
-      return this.onError("invalid content");
+      this.onError("invalid content");
+      return res.writeHead(400).end();
     }
 
     this.dataReq = req;
// Source: https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671

The patch adds res.writeHead(400).end() (and res.writeStatus("400 Bad Request").end() in the uWebSockets variant) so that the invalid request receives a 400 Bad Request response and the socket is properly closed.

Detection Methods for CVE-2026-59725

Indicators of Compromise

High volume of POST requests to Engine.IO polling endpoints (typically paths matching /socket.io/?EIO=4&transport=polling) with Content-Type: application/octet-stream.
Growing count of open TCP connections or ESTABLISHED sockets on Node.js processes hosting Socket.IO without corresponding response traffic.
Server logs recording repeated invalid content errors from the Engine.IO transport.

Detection Strategies

Inspect HTTP access logs for POST requests to Socket.IO polling paths with the application/octet-stream content type from a small set of source IPs.
Correlate application logs emitting Engine.IO invalid content errors with increases in socket count metrics.
Alert on file descriptor usage or netstat connection counts exceeding baseline for Node.js Socket.IO workers.

Monitoring Recommendations

Track process-level open file descriptors and TCP socket counts for services running engine.io between 4.1.0 and 6.6.6.
Monitor request rate and error rate on Socket.IO endpoints via reverse proxy or APM instrumentation.
Enable rate-limiting logs on ingress controllers or WAFs handling Socket.IO traffic to identify anomalous polling clients.

How to Mitigate CVE-2026-59725

Immediate Actions Required

Upgrade engine.io to version 6.6.7 or later across all Socket.IO deployments.
Audit dependency trees for transitive uses of vulnerable engine.io versions and rebuild affected applications.
Apply rate limiting and connection limits at the reverse proxy or load balancer in front of Socket.IO services.

Patch Information

The fix is available in engine.io@6.6.7. The patch closes the HTTP response with a 400 Bad Request status when invalid binary content is received under Engine.IO protocol v4. See the GitHub Security Advisory GHSA-r635-g3xr-vw7x, the engine.io 6.6.7 Release Notes, and the upstream commit fc11285 for details.

Workarounds

Configure the reverse proxy (nginx, HAProxy, Envoy) to reject POST requests to Socket.IO polling paths carrying Content-Type: application/octet-stream until upgrade is possible.
Enforce per-IP connection and request-rate limits on Socket.IO endpoints to slow socket exhaustion attempts.
Set aggressive HTTP request and idle socket timeouts on the Node.js server to reclaim stalled connections faster.

bash

# Upgrade engine.io to the patched release
npm install engine.io@6.6.7

# For applications depending on socket.io, refresh the lockfile
npm update socket.io engine.io
npm ls engine.io