Socket records

15 published records for vendor socket.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-2421No exploit	Socket.io - Improper type validation in attachment parsingsocket · socket.io-parser · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.2%	Oct 26, 2022
34Monitor	CVE-2026-33151No exploit	socket.io allows an unbounded number of binary attachmentssocket · socket.io-parser · CWE-20 Pre-auth	High8.7	—	0.6%	Mar 20, 2026
31Monitor	CVE-2020-36048No exploit	Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transportsocket · engine.io · CWE-400 Pre-auth Denial of service	High7.5	—	3.2%	Jan 7, 2021
31Monitor	CVE-2022-21676No exploit	Uncaught Exception in engine.iosocket · engine.io · CWE-754 Pre-auth Denial of service	High7.5	—	2.8%	Jan 12, 2022
31Monitor	CVE-2020-36049No exploit	socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation socket · socket.io-parser · CWE-770 Pre-auth Denial of service	High7.5	—	2.6%	Jan 7, 2021
31Monitor	CVE-2017-16031No exploit	Socket.io is a realtime application framework that provides communication via websockets.socket · socket.io · CWE-330 Pre-auth Weak crypto	High7.5	—	2.0%	Jun 4, 2018
30Monitor	CVE-2022-25867No exploit	NULL Pointer Dereferencesocket · socket.io-client java · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	1.6%	Aug 2, 2022
30Monitor	CVE-2023-32695No exploit	Insufficient validation when decoding a Socket.IO packetsocket · socket.io-parser · CWE-20 Pre-auth Denial of service	High7.5	—	1.1%	May 27, 2023
30Monitor	CVE-2026-59725No exploit	Socket.IO: Engine.IO Polling Transport Connection Exhaustionsocket · engine.io · CWE-404 Pre-auth Denial of service	High7.5	—	0.6%	Jul 8, 2026
30Monitor	CVE-2026-59724No exploit	Socket.IO: Engine.IO WebTransport SID DoSsocket · engine.io · CWE-20 Pre-auth Denial of service	High7.5	—	0.6%	Jul 8, 2026
29Monitor	CVE-2024-38355Proof of concept	Unhandled 'error' event in socket.iosocketio · socket.io · CWE-20 Pre-auth	High7.3	—	0.8%	Jun 19, 2024
27Monitor	CVE-2022-41940No exploit	Uncaught exception in engine.iosocket · engine.io · CWE-248 Denial of service	Medium6.5	—	2.1%	Nov 21, 2022
26Monitor	CVE-2023-31125No exploit	Uncaught exception in engine.iosocket · engine.io · CWE-248 Denial of service	Medium6.5	—	1.3%	May 8, 2023
23Monitor	CVE-2016-10536No exploit	engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatiosocket · engine.io-client · CWE-300 Pre-auth	Medium5.9	—	1.0%	May 31, 2018
17Monitor	CVE-2020-28481No exploit	The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration.socket · socket.io · CWE-346	Medium4.3	—	0.7%	Jan 19, 2021

CVE-2022-2421
39Monitor
Socket.io - Improper type validation in attachment parsing
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
socket · socket.io-parserOct 26, 2022
CVE-2026-33151
34Monitor
socket.io allows an unbounded number of binary attachments
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
socket · socket.io-parserMar 20, 2026
CVE-2020-36048
31Monitor
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport
HighCVSS 7.5No exploitEPSS 3%
- Pre-auth
- Denial of service
socket · engine.ioJan 7, 2021
CVE-2022-21676
31Monitor
Uncaught Exception in engine.io
HighCVSS 7.5No exploitEPSS 3%
- Pre-auth
- Denial of service
socket · engine.ioJan 12, 2022
CVE-2020-36049
31Monitor
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation
HighCVSS 7.5No exploitEPSS 3%
- Pre-auth
- Denial of service
socket · socket.io-parserJan 7, 2021
CVE-2017-16031
31Monitor
Socket.io is a realtime application framework that provides communication via websockets.
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Weak crypto
socket · socket.ioJun 4, 2018
CVE-2022-25867
30Monitor
NULL Pointer Dereference
HighCVSS 7.5No exploitEPSS 2%
socket · socket.io-client javaAug 2, 2022
CVE-2023-32695
30Monitor
Insufficient validation when decoding a Socket.IO packet
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
socket · socket.io-parserMay 27, 2023
CVE-2026-59725
30Monitor
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
socket · engine.ioJul 8, 2026
CVE-2026-59724
30Monitor
Socket.IO: Engine.IO WebTransport SID DoS
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
socket · engine.ioJul 8, 2026
CVE-2024-38355
29Monitor
Unhandled 'error' event in socket.io
HighCVSS 7.3Proof of conceptEPSS 1%
- Pre-auth
socketio · socket.ioJun 19, 2024
CVE-2022-41940
27Monitor
Uncaught exception in engine.io
MediumCVSS 6.5No exploitEPSS 2%
- Denial of service
socket · engine.ioNov 21, 2022
CVE-2023-31125
26Monitor
Uncaught exception in engine.io
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
socket · engine.ioMay 8, 2023
CVE-2016-10536
23Monitor
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatio
MediumCVSS 5.9No exploitEPSS 1%
- Pre-auth
socket · engine.io-clientMay 31, 2018
CVE-2020-28481
17Monitor
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration.
MediumCVSS 4.3No exploitEPSS 1%
socket · socket.ioJan 19, 2021