CVE-2026-33151: socket socket.io-parser Improper Input Validation
CVSS: 8.7v4.0HighAnalyzed
AliasesUBUNTU-CVE-2026-33151DEBIAN-CVE-2026-33151CGA-25mh-hfpv-c4c4CGA-2g96-vq8q-5w79CGA-3867-vpj9-56fmCGA-39f9-fjr7-cfxfCGA-3hc8-778m-64mrCGA-56gr-j5c7-39xcCGA-65jq-pgmm-gwwqCGA-666q-r375-jq69CGA-6f3g-6628-pw8mCGA-7826-ccfq-vh4pCGA-85qm-5hv5-w759CGA-876v-wwhf-r4wrCGA-cxj9-5h3q-g5v8CGA-h8vx-6vhj-jv76CGA-jqc2-xrpm-rjrhCGA-m88m-f9xh-f2w8CGA-mpc8-j9gp-w8m7CGA-mv6g-mgvh-q4mcCGA-qj3r-7wm4-jqgvCGA-vh22-494c-78wvGHSA-677m-j7p3-52f9CGA-fwq7-r45g-5crgCGA-pc6c-g99q-hgw2
Published 20-03-2026Last modified 23-03-2026
Vulnerability summary
CVE-2026-33151 is a high (CVSS 8.7) Improper Input Validation vulnerability in socket socket.io-parser. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.65%
0%100%
Low · +0.14 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 20-03-2026PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
CVSS metrics
9 scores · 7 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.14 pp
From 0.51% on 18-09-2026
18-09-202618-10-2026
EPSS score0.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Chainguard11 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
Wolfi10 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
Debian1 product
- node-socket.io-parserAll versions (No fix recorded) | < 4.2.1+~3.1.0-4
Npm1 product
- socket.io-parser< 3.3.5 | ≥ 3.4.0, < 3.4.4 | ≥ 4.0.0, < 4.2.6
Socket1 product
- socket.io-parser< 3.3.5 | ≥ 3.4.0, < 3.4.4 | ≥ 4.0.0, < 4.2.6
Socketio1 product
- socket.io< 3.3.5 | ≥ 3.4.0, < 3.4.4 | ≥ 4.0.0, < 4.2.6
Ubuntu1 product
- node-socket.io-parserAll versions (No fix recorded)
7 vendors · 26 products
References
10 links- github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9X Refsource CONFIRMREPORTAdvisoryWEBPatchVendor Advisory
- github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4X Refsource MISCREPORTFIXWEBPatch
- github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faafX Refsource MISCREPORTFIXWEBPatch
- github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78X Refsource MISCREPORTFIXWEBPatch
