CVE-2026-33151
Published: 20 March 2026
Summary
CVE-2026-33151 is a high-severity Improper Input Validation (CWE-20) vulnerability in Socket Socket.Io-Parser. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-33151 is a denial-of-service vulnerability in Socket.IO, an open-source real-time, bidirectional, event-based communication framework. In versions prior to 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can cause the server to wait indefinitely for a large number of binary attachments, leading it to buffer excessive data and exhaust available memory. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-20 (Improper Input Validation) and CWE-754 (Improper Check for Unusual or Exceptional Conditions).
Unauthenticated attackers with network access can exploit this issue with low complexity and no user interaction required. By sending the malicious packet, they trigger the server to allocate memory for numerous expected attachments that never arrive, resulting in resource exhaustion and potential service disruption or crash.
The vulnerability has been addressed in Socket.IO versions 3.3.5, 3.4.4, and 4.2.6, with fixes detailed in GitHub commits such as 719f9ebab0772ffb882bd614b387e585c1aa75d4, 9d39f1f080510f036782f2177fac701cc041faaf, and b25738c416c4e32fbff62ee182afa8f6d0dacf78, as well as the GHSA-677m-j7p3-52f9 security advisory. Security practitioners should upgrade affected Socket.IO installations to these patched versions to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13788
Vulnerability details
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be…
more
exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote unauthenticated exploitation of a Socket.IO input validation flaw that forces unbounded memory allocation for missing binary attachments, directly enabling Endpoint Denial of Service via Application or System Exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses CWE-20 by enforcing validation of Socket.IO packets to reject those specifying excessive binary attachments, preventing memory buffering and exhaustion.
Implements denial-of-service protections at network boundaries to limit resource consumption from specially crafted Socket.IO packets causing memory exhaustion.
Ensures timely patching of Socket.IO to vulnerable versions prior to 3.3.5, 3.4.4, and 4.2.6, remediating the input handling flaw.