GHSA-677m-j7p3-52f9
NoneCVSS
—
EPSS
—
Published
Mar 18, 2026
CISA due date
—
The record
socket.io allows an unbounded number of binary attachments
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | socket.io-parser | 0 | 3.3.5 |
| npm | socket.io-parser | 3.4.0 | 3.4.4 |
| npm | socket.io-parser | 4.0.0 | 4.2.6 |
Related vulnerabilities
- CVE-2026-33151 Socket.IO is an open source, real-time, bidirectional, event-based, communication… Same vulnerability
- CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. CWE-754
- CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep… CWE-754
- CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-754
- CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
- CVE-2026-87548 Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a… CWE-754
- CVE-2026-87532 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
- CVE-2026-73314 XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST… CWE-754