{"id":"CVE-2026-102600","kind":"vulnerability","aliases":["CVE-2026-102600","GHSA-wfpm-5gcm-94cg"],"related":[],"title":"Socket.IO: Prototype Pollution via Unsafe Client Session Lookup","description":"### Impact\r\n\r\nThis is a **prototype pollution / improper client lookup** vulnerability in `@socket.io/cluster-engine`.\r\n\r\nServers using `@socket.io/cluster-engine` may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as `__proto__`, `constructor`, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients.\r\n\r\nThe impact is **denial of service** through process crash.\r\n\r\nApplications not using `@socket.io/cluster-engine` are not affected by this specific issue.\r\n\r\nAffected versions:\r\n\r\n*  `@socket.io/cluster-engine@0.1.0`\r\n\r\n### Patches\r\n\r\nThe issue was fixed in:\r\n\r\n*  `@socket.io/cluster-engine@0.1.1`\r\n\r\n### Workarounds\r\n\r\nIf upgrading immediately is not possible, users can reduce exposure by:\r\n\r\n- Rejecting or sanitizing suspicious session IDs before they reach the cluster engine.\r\n- Running the cluster engine behind trusted infrastructure that prevents arbitrary clients from crafting raw Engine.IO session-related requests.\r\n\r\nThese workarounds are defense-in-depth only. Upgrading to a patched version is recommended.\r\n\r\n### References\r\n\r\n- Commit: https://github.com/socketio/socket.io/commit/830e364\r\n- Socket.IO repository: https://github.com/socketio/socket.io\r\n- Package: https://www.npmjs.com/package/@socket.io/cluster-engine","summary":"A malicious client can send special property names such as __proto__ or constructor as a session ID to @socket.io/cluster-engine in a clustered deployment. The server then reads inherited prototype properties, which crashes the process (denial of service).","severity":"high","cvss":7.5,"epss":0.00382,"exploited":false,"exploited_at":null,"products":[{"name":"@socket.io/cluster-engine","note":"<0.1.1","fixed":["0.1.1"],"affected":"< 0.1.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["clustered-deployments","cwe-20","node","package","self-hosted","socket.io"],"not_affected_if":["package-not-used","single-instance-deployment"],"how_to_check":"- Look for `@socket.io/cluster-engine` in `package.json` or the lockfile and check the installed version, for example with `npm ls @socket.io/cluster-engine`\n- Confirm whether the server runs in a clustered deployment using this package\n- Versions below `0.1.1` are affected","fix":"- `@socket.io/cluster-engine` upgrade to `0.1.1`\n- Until upgraded, the advisory suggests rejecting or sanitizing suspicious session IDs before they reach the cluster engine (defense-in-depth only)","status":"open","published_at":"2026-09-24T08:21:04+00:00","first_seen_at":"2026-11-09T22:53:20+00:00","triaged_at":"2026-11-09T22:59:26+00:00","updated_at":"2026-11-09T22:59:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:59:26Z","model":"claude-haiku-5-5","output":{"fix":"- `@socket.io/cluster-engine` upgrade to `0.1.1`\n- Until upgraded, the advisory suggests rejecting or sanitizing suspicious session IDs before they reach the cluster engine (defense-in-depth only)","reach":"internet","title":"Socket.IO cluster engine: crafted session IDs crash the server process","impact":"medium","summary":"A malicious client can send special property names such as __proto__ or constructor as a session ID to @socket.io/cluster-engine in a clustered deployment. The server then reads inherited prototype properties, which crashes the process (denial of service).","audience":"developers","category":"package","nicknames":[],"who_cares":["socket.io","node","self-hosted","clustered-deployments"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"remote client crashes the server process via crafted session ID","analyst_note":"","how_to_check":"- Look for `@socket.io/cluster-engine` in `package.json` or the lockfile and check the installed version, for example with `npm ls @socket.io/cluster-engine`\n- Confirm whether the server runs in a clustered deployment using this package\n- Versions below `0.1.1` are affected","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["package-not-used","single-instance-deployment"],"who_is_affected":"Only servers that use `@socket.io/cluster-engine` in a clustered deployment and process attacker-controlled session IDs are exposed. Applications that do not use this package are not affected by this issue.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000801,"input_tokens":5121,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102600':11A,19A '-20':27B '-2026':10A,18A '/cluster-engine':22A,54B,86C,91C,158C '/cluster-engine@0.1.0':170C '/cluster-engine@0.1.1':179C '/package/@socket.io/cluster-engine':251C '/socketio/socket.io':247C '/socketio/socket.io/commit/830e364':242C '5gcm':15A '94cg':16A 'affect':161C,166C 'applic':153C 'arbitrari':213C 'attack':97C 'attacker-control':96C 'behind':208C 'caus':127C 'chain':137C 'client':6A,36B,80C,108C,143C,214C 'cluster':24B,57B,104C,202C,206C 'clustered-deploy':23B 'commit':239C 'connect':142C 'constructor':46B,117C 'control':98C 'could':109C 'craft':216C 'crash':67B,152C 'cve':9A,17A 'cwe':26B 'defens':227C 'defense-in-depth':226C 'denial':70B,147C 'deploy':25B,58B,105C 'depth':229C 'engin':203C,207C 'engine.io':218C 'exposur':190C 'fix':175C 'ghsa':13A 'ghsa-wfpm-5gcm-94cg':12A 'github.com':241C,246C 'github.com/socketio/socket.io':245C 'github.com/socketio/socket.io/commit/830e364':240C 'host':32B 'id':50B,100C,197C 'identifi':126C 'immedi':183C 'impact':73C,94C,145C 'improp':79C 'infrastructur':210C 'inherit':63B,120C 'instead':138C 'issu':165C,173C 'key':122C 'lookup':8A,81C 'malici':35B,107C 'may':92C 'name':41B,113C 'node':28B 'object':121C,135C 'packag':29B,248C 'patch':171C,234C 'pollut':3A,78C 'possibl':186C 'prevent':212C 'process':69B,102C,151C 'properti':40B,65B,112C,132C 'proto':44B,116C 'prototyp':2A,64B,77C,136C 'raw':217C 'reach':200C 'read':62B,131C 'real':141C 'recommend':237C 'reduc':189C 'refer':238C 'reject':192C 'relat':221C 'repositori':244C 'request':222C 'run':204C 'sanit':194C 'self':31B 'self-host':30B 'send':38B 'server':60B,87C,129C 'servic':72B,149C 'session':7A,49B,99C,125C,196C,220C 'session-rel':219C 'socket.io':1A,21A,33B,53B,85C,90C,157C,169C,178C,243C 'socket.io/cluster-engine':20A,52B,84C,89C,156C 'socket.io/cluster-engine@0.1.0':168C 'socket.io/cluster-engine@0.1.1':177C 'special':39B,111C 'specif':164C 'suspici':195C 'trust':209C 'unsaf':5A 'upgrad':182C,231C 'use':88C,110C,155C 'user':187C 'version':167C,235C 'via':4A 'vulner':82C 'wfpm':14A 'workaround':180C,224C 'www.npmjs.com':250C 'www.npmjs.com/package/@socket.io/cluster-engine':249C","nicknames":[],"mitigations":[],"who_affected":"Only servers that use `@socket.io/cluster-engine` in a clustered deployment and process attacker-controlled session IDs are exposed. Applications that do not use this package are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["clusterengine"],"ptokens":["cluster","engine","io","socket"],"labels":["clustereddeployments","cwe20","high","node","npm","package","selfhosted","socketio"],"campaign_type":null,"search_a":"'-102600':11A,19A '-2026':10A,18A '/cluster-engine':22A '5gcm':15A '94cg':16A 'client':6A 'cve':9A,17A 'ghsa':13A 'ghsa-wfpm-5gcm-94cg':12A 'lookup':8A 'pollut':3A 'prototyp':2A 'session':7A 'socket.io':1A,21A 'socket.io/cluster-engine':20A 'unsaf':5A 'via':4A 'wfpm':14A","search_b":"'-20':27B '/cluster-engine':54B 'client':36B 'cluster':24B,57B 'clustered-deploy':23B 'constructor':46B 'crash':67B 'cwe':26B 'denial':70B 'deploy':25B,58B 'host':32B 'id':50B 'inherit':63B 'malici':35B 'name':41B 'node':28B 'packag':29B 'process':69B 'properti':40B,65B 'proto':44B 'prototyp':64B 'read':62B 'self':31B 'self-host':30B 'send':38B 'server':60B 'servic':72B 'session':49B 'socket.io':33B,53B 'socket.io/cluster-engine':52B 'special':39B","search_c":"'/cluster-engine':86C,91C,158C '/cluster-engine@0.1.0':170C '/cluster-engine@0.1.1':179C '/package/@socket.io/cluster-engine':251C '/socketio/socket.io':247C '/socketio/socket.io/commit/830e364':242C 'affect':161C,166C 'applic':153C 'arbitrari':213C 'attack':97C 'attacker-control':96C 'behind':208C 'caus':127C 'chain':137C 'client':80C,108C,143C,214C 'cluster':104C,202C,206C 'commit':239C 'connect':142C 'constructor':117C 'control':98C 'could':109C 'craft':216C 'crash':152C 'defens':227C 'defense-in-depth':226C 'denial':147C 'deploy':105C 'depth':229C 'engin':203C,207C 'engine.io':218C 'exposur':190C 'fix':175C 'github.com':241C,246C 'github.com/socketio/socket.io':245C 'github.com/socketio/socket.io/commit/830e364':240C 'id':100C,197C 'identifi':126C 'immedi':183C 'impact':73C,94C,145C 'improp':79C 'infrastructur':210C 'inherit':120C 'instead':138C 'issu':165C,173C 'key':122C 'lookup':81C 'malici':107C 'may':92C 'name':113C 'object':121C,135C 'packag':248C 'patch':171C,234C 'pollut':78C 'possibl':186C 'prevent':212C 'process':102C,151C 'properti':112C,132C 'proto':116C 'prototyp':77C,136C 'raw':217C 'reach':200C 'read':131C 'real':141C 'recommend':237C 'reduc':189C 'refer':238C 'reject':192C 'relat':221C 'repositori':244C 'request':222C 'run':204C 'sanit':194C 'server':87C,129C 'servic':149C 'session':99C,125C,196C,220C 'session-rel':219C 'socket.io':85C,90C,157C,169C,178C,243C 'socket.io/cluster-engine':84C,89C,156C 'socket.io/cluster-engine@0.1.0':168C 'socket.io/cluster-engine@0.1.1':177C 'special':111C 'specif':164C 'suspici':195C 'trust':209C 'upgrad':182C,231C 'use':88C,110C,155C 'user':187C 'version':167C,235C 'vulner':82C 'workaround':180C,224C 'www.npmjs.com':250C 'www.npmjs.com/package/@socket.io/cluster-engine':249C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-24T08:21:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-wfpm-5gcm-94cg","url":"https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg","severity":"high","published_at":"2026-09-24T08:21:04+00:00","modified_at":"2026-09-29T15:21:56+00:00","first_seen_at":"2026-11-09T22:53:20+00:00","fetched_at":"2026-11-09T22:53:20+00:00","note":null},{"source":"ghsa","external_id":"GHSA-wfpm-5gcm-94cg","url":"https://github.com/advisories/GHSA-wfpm-5gcm-94cg","severity":"high","published_at":"2026-10-05T23:44:21+00:00","modified_at":"2026-10-05T23:44:22+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-102600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102600","severity":null,"published_at":"2026-09-29T16:17:06+00:00","modified_at":"2026-09-30T19:38:27+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110512,"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-24T08:21:04+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110865,"url":"https://api.github.com/repos/socketio/socket.io/security-advisories/GHSA-wfpm-5gcm-94cg","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110867,"url":"https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110868,"url":"https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00382,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102600"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}