All vulnerabilities
CVE-2026-102600GHSA-wfpm-5gcm-94cg

@socket.io/cluster-engine: Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

socketio @socket.io/cluster-enginenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.1.1Fixed versionGitHub
Published29 Sep 2026Updated 6 Oct 2026CVE List

What fixes it

  • 0.1.1@socket.io/cluster-engine, npmGitHubnpm install @socket.io/cluster-engine@0.1.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine.

Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as __proto__, constructor, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients.

The impact is denial of service through process crash.

Applications not using @socket.io/cluster-engine are not affected by this specific issue.

Affected versions:

  • @socket.io/cluster-engine@0.1.0

Patches

The issue was fixed in:

  • @socket.io/cluster-engine@0.1.1

Workarounds

If upgrading immediately is not possible, users can reduce exposure by:

  • Rejecting or sanitizing suspicious session IDs before they reach the cluster engine.
  • Running the cluster engine behind trusted infrastructure that prevents arbitrary clients from crafting raw Engine.IO session-related requests.

These workarounds are defense-in-depth only. Upgrading to a patched version is recommended.

Text from GitHub Advisory Database

Affected versions 4

  • @socket.io/cluster-engine, npm< 0.1.1GitHub
  • socket.ioaffected: < 0.1.1CVE List
  • cluster-engineaffected: < 0.1.1CVE List
  • @socket.io/cluster-engine, npmfrom first release, fixed in 0.1.1OSV

References 5