This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-69185 →

DEBIAN-CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO pack...

Original description

The description as published by the source.

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-socket.io-parser

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-socket.io-parser

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-socket.io-parser

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4+~3.1.2-1"}]}]

References

advisory security-tracker.debian.org