@SOCKET.IO/CLUSTER-ENGINE · CVE-2026-102600 · Package
FIX → 0.1.1
A malicious client can send special property names such as __proto__ or constructor as a session ID to @socket.io/cluster-engine in a clustered deployment. The server then reads inherited prototype properties, which crashes the process (denial of service).
first public Sep 24, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only servers that use @socket.io/cluster-engine in a clustered deployment and process attacker-controlled session IDs are exposed. Applications that do not use this package are not affected by this issue.
Not affected if package-not-used, single-instance-deployment
Who cares clustered-deployments, node, self-hosted, socket.io
@socket.io/cluster-engine in package.json or the lockfile and check the installed version, for example with npm ls @socket.io/cluster-engine0.1.1 are affectedUpgrade to 0.1.1
This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine.
Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as __proto__, constructor, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients.
The impact is denial of service through process crash.
Applications not using @socket.io/cluster-engine are not affected by this specific issue.
Affected versions:
@socket.io/cluster-engine@0.1.0The issue was fixed in:
@socket.io/cluster-engine@0.1.1If upgrading immediately is not possible, users can reduce exposure by:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
@socket.io/cluster-engine upgrade to 0.1.1These workarounds are defense-in-depth only. Upgrading to a patched version is recommended.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.