Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
### Impact This is a **prototype pollution / improper client lookup** vulnerability in `@socket.io/cluster-engine`. Servers using `@socket.io/cluster-engine` may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as `__proto__`, `constructor`, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients. The impact is **denial of service** through process crash. Applications not using `@socket.io/cluster-engine` are not affected by this specific issue. Affected versions: * `@socket.io/cluster-engine@0.1.0` ### Patches The issue was fixed in: * `@socket.io/cluster-engine@0.1.1` ### Workarounds If upgrading immediately is not possible, users can reduce exposure by: - Rejecting or sanitizing suspicious session IDs before they reach the cluster engine. - Running the cluster engine behind trusted infrastructure that prevents arbitrary clients from crafting raw Engine.IO session-related requests. These workarounds are defense-in-depth only. Upgrading to a patched version is recommended.
GHSA-wfpm-5gcm-94cg
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-wfpm-5gcm-94cg
@socket.io/cluster-engine
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.1"
}
]
}
],
"package": {
"name": "@socket.io/cluster-engine",
"purl": "pkg:npm/%40socket.io/cluster-engine",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-wfpm-5gcm-94cg/GHSA-wfpm-5gcm-94cg.json"
}
}
]- Related CVEs
- CVE-2026-102600
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #85960 · Revision 1
- Added to Heist Feed
- Publisher date