CVE-2026-59724: Socket.IO: Engine.IO WebTransport SID DoS
Vulnerability summary
CVE-2026-59724 is a high (CVSS 7.5) Improper Input Validation vulnerability in socket engine.io. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- jupyter-base-notebook< 7.6.3-r2
- tensorflow-gpu-jupyter< 2.21.0-r9
Npm1 product
- engine.io≥ 6.5.0, < 6.6.7
Socket1 product
- engine.io≥ 6.5.0, < 6.6.7
Socketio1 product
- socket.io≥ 6.5.0, < 6.6.7
Wolfi1 product
- jupyter-base-notebook< 7.6.3-r2
5 vendors · 6 products
References
6 links- github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3X Refsource CONFIRMAdvisoryWEBPatchVendor AdvisoryMitigation
- github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158cX Refsource MISCFIXWEBPatch
