{"items":[{"id":"NVI-00015401","kind":"vulnerability","title":"Socket.IO: Engine.IO WebTransport SID DoS","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gr94-w7qr-f4j3","CVE-2026-59724"],"plain_summary":"GitHub lists this reviewed advisory for engine.io. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6430ec23ba45eaad59fa8546cc1744fd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-31T21:28:13.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6430ec23ba45eaad59fa8546cc1744fd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6430ec23ba45eaad59fa8546cc1744fd","url":"https://github.com/advisories/GHSA-gr94-w7qr-f4j3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gr94-w7qr-f4j3","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:58.521Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6430ec23ba45eaad59fa8546cc1744fd"],"technology":"engine.io","known_exclusions":[],"conditions_summary":"### Impact\n\nEngine.IO servers with **WebTransport enabled** are vulnerable to a remotely triggerable denial of service.\n\nA malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as `__proto__`. Because the session ID lookup did not properly verify that the key was an own property of the clients object, the lookup could resolve to an inherited prototype property instead of a valid Engine.IO client.\n\nThis can cause a `TypeError` during WebTransport upgrade handling. Since the failure occurs in an asynchronous context, it may result in an unhandled Promise rejection and terminate the Node.js process on affected Node.js versions/configurations.\n\nSuccessful exploitation can allow an unauthenticated remote attacker to crash the server process and cause denial of service. Under a process supervisor, repeated exploitation may cause crash loops.\n\nAffected configurations are limited to deployments where WebTransport support is enabled. WebTransport is not enabled by default.\n\nAffected versions:\n\n- `engine.io >= 6.5.0 < 6.6.7`\n\n## Patches\n\nThe issue was fixed in:\n\n- **engine.io 6.6.7**\n\nUsers should upgrade to `engine.io","public_affected_ranges":[">= 6.5.0, < 6.6.7"]}],"null_published_at":"2026-11-03T10:03:31.363Z","source_updated_at":"2026-08-31T21:28:13.000Z","source_disclosed_at":"2026-08-31T21:28:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:58.521Z"}],"next_cursor":null,"snapshot_revision":"42594"}