CVE-2026-69185

About vulnerability

Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

Patches

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion [here](https://github.com/socketio/socket.io/discussions)

Affected product:

babel-plugin-remove-graphql-queries , ember-cli , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-emotion , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , karma , karma-mocha-reporter , npm:gatsby-theme-blog-core , open-wc-testing-karma , open-wc-testing-karma-bs , socket.io , socket.io-client , socket.io-parser , testcafe , testem , theme-ui

Affected packages:

socket.io-parser @ 3.2.0 (+580 more)