{"items":[{"id":"NVI-00013019","kind":"vulnerability","title":"Socket.IO: Engine.IO Protocol Revision Mismatch DoS","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-2gc4-cqfq-p2gv","CVE-2026-102599"],"plain_summary":"GitHub lists this reviewed advisory for engine.io. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2d035947d7c3793cb9c694a4debe9b5a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-29T23:44:34.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3d63d1084933503d4134e5ed066b89ec"},{"kind":"CVSS","as_of":"2026-10-17T02:17:08.197Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-1e0ebb88d52c355951b4e20801e014e0"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.576%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.47496. Missing scores are unknown.","source_id":"sr-2d035947d7c3793cb9c694a4debe9b5a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3d63d1084933503d4134e5ed066b89ec","url":"https://github.com/advisories/GHSA-2gc4-cqfq-p2gv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2gc4-cqfq-p2gv","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"},{"id":"sr-1e0ebb88d52c355951b4e20801e014e0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102599","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-102599","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:04.487Z"},{"id":"sr-2d035947d7c3793cb9c694a4debe9b5a","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-102599","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.837Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3d63d1084933503d4134e5ed066b89ec"],"technology":"engine.io","known_exclusions":[],"conditions_summary":"### Impact\n\nA denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades.\n\nThe Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session.\n\nA malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, `EIO` query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process.\n\nServers using the default Engine.IO v4 protocol are impacted. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted `EIO` parameter is interpreted as protocol v3 on the affected transport path.\n\nThe impact is **denia","public_affected_ranges":[">= 6.6.0, < 6.6.10"]}],"null_published_at":"2026-11-08T19:53:38.917Z","source_updated_at":"2026-09-29T23:44:34.000Z","source_disclosed_at":"2026-09-29T23:44:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T07:24:25.558Z"},{"id":"NVI-00013019","kind":"vulnerability","title":"Socket.IO: Engine.IO Protocol Revision Mismatch DoS","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-2gc4-cqfq-p2gv","CVE-2026-102599"],"plain_summary":"GitHub lists this reviewed advisory for engine.io. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1e0ebb88d52c355951b4e20801e014e0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-29T23:44:34.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3d63d1084933503d4134e5ed066b89ec"},{"kind":"CVSS","as_of":"2026-10-17T02:17:08.197Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-1e0ebb88d52c355951b4e20801e014e0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3d63d1084933503d4134e5ed066b89ec","url":"https://github.com/advisories/GHSA-2gc4-cqfq-p2gv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2gc4-cqfq-p2gv","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"},{"id":"sr-1e0ebb88d52c355951b4e20801e014e0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102599","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-102599","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:04.487Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3d63d1084933503d4134e5ed066b89ec"],"technology":"engine.io","known_exclusions":[],"conditions_summary":"### Impact\n\nA denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades.\n\nThe Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session.\n\nA malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, `EIO` query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process.\n\nServers using the default Engine.IO v4 protocol are impacted. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted `EIO` parameter is interpreted as protocol v3 on the affected transport path.\n\nThe impact is **denia","public_affected_ranges":[">= 6.6.0, < 6.6.10"]}],"null_published_at":"2026-11-03T10:03:31.376Z","source_updated_at":"2026-09-29T23:44:34.000Z","source_disclosed_at":"2026-09-29T23:44:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:25.558Z"},{"id":"NVI-00013019","kind":"vulnerability","title":"Socket.IO: Engine.IO Protocol Revision Mismatch DoS","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2gc4-cqfq-p2gv","CVE-2026-102599"],"plain_summary":"GitHub lists this reviewed advisory for engine.io. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3d63d1084933503d4134e5ed066b89ec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-29T23:44:34.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3d63d1084933503d4134e5ed066b89ec"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3d63d1084933503d4134e5ed066b89ec","url":"https://github.com/advisories/GHSA-2gc4-cqfq-p2gv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2gc4-cqfq-p2gv","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3d63d1084933503d4134e5ed066b89ec"],"technology":"engine.io","known_exclusions":[],"conditions_summary":"### Impact\n\nA denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades.\n\nThe Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session.\n\nA malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, `EIO` query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process.\n\nServers using the default Engine.IO v4 protocol are impacted. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted `EIO` parameter is interpreted as protocol v3 on the affected transport path.\n\nThe impact is **denia","public_affected_ranges":[">= 6.6.0, < 6.6.10"]}],"null_published_at":"2026-11-01T07:29:12.909Z","source_updated_at":"2026-09-29T23:44:34.000Z","source_disclosed_at":"2026-09-29T23:44:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:25.558Z"}],"next_cursor":null,"snapshot_revision":"42594"}