Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Impact
This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine.
Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as __proto__, constructor, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients.
The impact is denial of service through process crash.
Applications not using @socket.io/cluster-engine are not affected by this specific issue.
Affected versions:
@socket.io/cluster-engine@0.1.0
Patches
The issue was fixed in:
@socket.io/cluster-engine@0.1.1
Workarounds
If upgrading immediately is not possible, users can reduce exposure by:
- Rejecting or sanitizing suspicious session IDs before they reach the cluster engine.
- Running the cluster engine behind trusted infrastructure that prevents arbitrary clients from crafting raw Engine.IO session-related requests.
These workarounds are defense-in-depth only. Upgrading to a patched version is recommended.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @socket.io/cluster-engine | < 0.1.1 | 0.1.1 |
Referencias
- https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg
- https://nvd.nist.gov/vuln/detail/CVE-2026-102600
- https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
- https://github.com/socketio/socket.io
- https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-20- Plataforma
- npm
- Paquete
@socket.io/cluster-engine- Publicada
- 05.10.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-wfpm-5gcm-94cg - CC BY 4.0
Historial de vulnerabilidades: @socket.io/cluster-engine
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.