CVE-2026-33151: Socket.io parser Socket.io Allows An Unbounded Number Vulnerability
HIGHCVE-2026-33151 is a HIGH socket.io allows an unbounded number vulnerability (CWE-754: Improper Check for Unusual or Exceptional Conditions) affecting Socket.io parser libraries in the npm ecosystem. The issue involves socket.io allows an unbounded number of binary attachments. Remediation is available by upgrading affected packages to version 4.2.6, 3.4.4, 3.3.5.
CVE-2026-33151 at a Glance
How to Fix CVE-2026-33151
To remediate this vulnerability, upgrade all affected Socket.io parser dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install socket.io-parser@4.2.6npm install socket.io-parser@3.4.4npm install socket.io-parser@3.3.5Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls socket.io-parserHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-33151, inspect your project dependencies using npm:
npm ls socket.io-parserAnalyze the terminal output to locate any version of Socket.io parser in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.6), your application is affected.
Note: The npm ls socket.io-parser command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-754: Improper Check for Unusual or Exceptional Conditions, where the product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. In Socket.io parser, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-33151 Affected Socket.io parser Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
socket.io-parser
|
npm |
≥ 4.0.0
< 4.2.6
|
4.2.6
|
|
socket.io-parser
|
npm |
≥ 3.4.0
< 3.4.4
|
3.4.4
|
|
socket.io-parser
|
npm |
< 3.3.5
|
3.3.5
|
References
Frequently Asked Questions
What is CVE-2026-33151?
Which Socket.io parser versions are affected?
What version fixes CVE-2026-33151?
Is socket.io-parser affected?
What CWE is associated with CVE-2026-33151?
How can I check npm dependencies for CVE-2026-33151?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-677m-j7p3-52f9",
"modified" : "2026-03-20T21:33:51Z",
"published" : "2026-03-18T17:26:14Z",
"aliases" : [ "CVE-2026-33151" ],
"summary" : "socket.io allows an unbounded number of binary attachments",
"details" : "### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range | Used by | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `>=4.0.0 <4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6` |\n| `>=3.4.0 <3.4.4` | `socket.io@2.x` | `3.4.4` |\n| `<3.3.5` | `socket.io-client@2.x` | `3.3.5` |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "socket.io-parser"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.3.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "socket.io-parser"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.4.0"
}, {
"fixed" : "3.4.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "socket.io-parser"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.2.6"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33151"
}, {
"type" : "WEB",
"url" : "https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4"
}, {
"type" : "WEB",
"url" : "https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf"
}, {
"type" : "WEB",
"url" : "https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/socketio/socket.io"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-754" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-18T17:26:14Z",
"nvd_published_at" : "2026-03-20T21:17:15Z"
}
}