Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@socket.io/cluster-engine

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

    CVE-2026-102600 · GHSA-wfpm-5gcm-94cg

    Affected
    • npm @socket.io/cluster-engine < 0.1.1
    Fixed in
    0.1.1· Vendor fix available
    Issue
    Impact This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine. Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as proto, constructor, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients. The impact is denial of service through process crash. Applications not using @socket.io/cluster-engine are not affected by this specific issue. Affected versions: @socket.io/cluster-engine@0.1.0 Patches The issue was fixed in: @socket.io/cluster-engine@0.1.1 Workarounds If upgrading immediately is not possible, users can reduce exposure by: - Rejecting or sanitizing suspicious session IDs before they reach the cluster engine. - Running the cluster engine behind trusted infrastructure that prevents arbitrary…

    Recommended action: Upgrade to 0.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →