[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-59725":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T17:19:26.604Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":194,"aliases":195,"duplicate_of":9,"upstream":197,"downstream":198,"duplicates":201,"related":202,"reserved_at":9,"published_at":203,"modified_at":204,"state":205,"summary":206,"references_raw":213,"kevs":240,"epss":9,"epss_history":241,"metrics":242,"affected":250},"CVE-2026-59725","Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-404","Improper Resource Shutdown or Release","The product does not release or incorrectly releases a resource before it is made available for re-use.","weakness","Draft","Class","Medium",[20,106,116,146,150,154,158],{"id":21,"name":22,"techniques":23},"CAPEC-125","Flooding",[24,78],{"id":25,"name":26,"tactics":27,"countermeasures":31},"T1498.001","Direct Network Flood",[28],{"id":29,"name":30},"TA0105","Impact",[32,37,41,45,49,53,57,61,65,69,74],{"id":33,"name":34,"tactic":35},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":36},"Detect",{"id":38,"name":39,"tactic":40},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":36},{"id":42,"name":43,"tactic":44},"D3-CSPP","Client-server Payload Profiling",{"name":36},{"id":46,"name":47,"tactic":48},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":36},{"id":50,"name":51,"tactic":52},"D3-NTSA","Network Traffic Signature Analysis",{"name":36},{"id":54,"name":55,"tactic":56},"D3-APCA","Application Protocol Command Analysis",{"name":36},{"id":58,"name":59,"tactic":60},"D3-NTCD","Network Traffic Community Deviation",{"name":36},{"id":62,"name":63,"tactic":64},"D3-RTSD","Remote Terminal Session Detection",{"name":36},{"id":66,"name":67,"tactic":68},"D3-ISVA","Inbound Session Volume Analysis",{"name":36},{"id":70,"name":71,"tactic":72},"D3-NTF","Network Traffic Filtering",{"name":73},"Isolate",{"id":75,"name":76,"tactic":77},"D3-ITF","Inbound Traffic Filtering",{"name":73},{"id":79,"name":80,"tactics":81,"countermeasures":83},"T1499","Endpoint Denial of Service",[82],{"id":29,"name":30},[84,86,88,90,92,94,96,98,100,102,104],{"id":33,"name":34,"tactic":85},{"name":36},{"id":38,"name":39,"tactic":87},{"name":36},{"id":42,"name":43,"tactic":89},{"name":36},{"id":46,"name":47,"tactic":91},{"name":36},{"id":50,"name":51,"tactic":93},{"name":36},{"id":54,"name":55,"tactic":95},{"name":36},{"id":58,"name":59,"tactic":97},{"name":36},{"id":62,"name":63,"tactic":99},{"name":36},{"id":66,"name":67,"tactic":101},{"name":36},{"id":70,"name":71,"tactic":103},{"name":73},{"id":75,"name":76,"tactic":105},{"name":73},{"id":107,"name":108,"techniques":109},"CAPEC-130","Excessive Allocation",[110],{"id":111,"name":112,"tactics":113,"countermeasures":115},"T1499.003","Application Exhaustion Flood",[114],{"id":29,"name":30},[],{"id":117,"name":118,"techniques":119},"CAPEC-131","Resource Leak Exposure",[120],{"id":79,"name":80,"tactics":121,"countermeasures":123},[122],{"id":29,"name":30},[124,126,128,130,132,134,136,138,140,142,144],{"id":33,"name":34,"tactic":125},{"name":36},{"id":38,"name":39,"tactic":127},{"name":36},{"id":42,"name":43,"tactic":129},{"name":36},{"id":46,"name":47,"tactic":131},{"name":36},{"id":50,"name":51,"tactic":133},{"name":36},{"id":54,"name":55,"tactic":135},{"name":36},{"id":58,"name":59,"tactic":137},{"name":36},{"id":62,"name":63,"tactic":139},{"name":36},{"id":66,"name":67,"tactic":141},{"name":36},{"id":70,"name":71,"tactic":143},{"name":73},{"id":75,"name":76,"tactic":145},{"name":73},{"id":147,"name":148,"techniques":149},"CAPEC-494","TCP Fragmentation",[],{"id":151,"name":152,"techniques":153},"CAPEC-495","UDP Fragmentation",[],{"id":155,"name":156,"techniques":157},"CAPEC-496","ICMP Fragmentation",[],{"id":159,"name":160,"techniques":161},"CAPEC-666","BlueSmacking",[162,188],{"id":25,"name":26,"tactics":163,"countermeasures":165},[164],{"id":29,"name":30},[166,168,170,172,174,176,178,180,182,184,186],{"id":33,"name":34,"tactic":167},{"name":36},{"id":38,"name":39,"tactic":169},{"name":36},{"id":42,"name":43,"tactic":171},{"name":36},{"id":46,"name":47,"tactic":173},{"name":36},{"id":50,"name":51,"tactic":175},{"name":36},{"id":54,"name":55,"tactic":177},{"name":36},{"id":58,"name":59,"tactic":179},{"name":36},{"id":62,"name":63,"tactic":181},{"name":36},{"id":66,"name":67,"tactic":183},{"name":36},{"id":70,"name":71,"tactic":185},{"name":73},{"id":75,"name":76,"tactic":187},{"name":73},{"id":189,"name":190,"tactics":191,"countermeasures":193},"T1499.001","OS Exhaustion Flood",[192],{"id":29,"name":30},[],[],[196],"GHSA-r635-g3xr-vw7x",[],[199],{"_key":200},"RHSA-2026:37577",[],[],"2026-07-08T15:37:52.293Z","2026-07-08T17:00:32.946Z","PUBLISHED",{"cisa_kev":207,"cisa_ransomware":207,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":208,"severity_score":209,"severity_version":210,"severity_source":211,"severity_vector":212,"severity_status":205},false,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[214,221,226,230,235],{"url":215,"sources":216,"tags":218},"https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x",[211,217],"osv_npm",[219,220],"X Refsource CONFIRM","WEB",{"url":222,"sources":223,"tags":224},"https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671",[211,217],[225,220],"X Refsource MISC",{"url":227,"sources":228,"tags":229},"https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7",[211,217],[225,220],{"url":231,"sources":232,"tags":233},"https://nvd.nist.gov/vuln/detail/CVE-2026-59725",[217],[234],"Advisory",{"url":236,"sources":237,"tags":238},"https://github.com/socketio/socket.io",[217],[239],"PACKAGE",[],[],[243,248],{"source":211,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":244,"cvss_v4_0":9},{"baseScore":209,"baseSeverity":245,"vectorString":212,"impactScore":246,"exploitabilityScore":247},"HIGH",6,10,{"source":217,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":249,"cvss_v4_0":9},{"baseScore":209,"baseSeverity":9,"vectorString":212,"impactScore":246,"exploitabilityScore":247},[251,264],{"ecosystem":252,"name":253,"vendor":252,"product":253,"cpe_part":9,"purl_type":254,"purl_namespace":9,"purl_name":253,"source":9,"versions":255},"Npm","engine.io","npm",[256],{"version":257,"is_range":258,"range_type":259,"version_start":260,"version_start_type":261,"version_end":262,"version_end_type":263,"fixed_in":9},"gte4_1_0_lt6_6_7",true,"semver","4.1.0","including","6.6.7","excluding",{"ecosystem":9,"name":265,"vendor":266,"product":265,"cpe_part":267,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":268},"socket.io","socketio","a",[269],{"version":270,"is_range":258,"range_type":211,"version_start":260,"version_start_type":261,"version_end":262,"version_end_type":263,"fixed_in":9},">= 4.1.0, \u003C 6.6.7"]