Socket.IO — CVE history (npm)
Socket.IO
7 CVEs affect the Socket.IO npm package (highest CVSS 7.5). Latest disclosed: 2026-08-03. Full CVE history sourced from NVD.
Summary
- Package
Socket.IO(npm)- Total CVEs
7- Actively exploited (CISA KEV)
- 0
- Highest CVSS
7.5- Latest disclosed
- 2026-08-03
Recent CVEs (top 7)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-69185 | High | 7.5 | — | 2026-08-03 | Socket.IO enables bidirectional and low-latency communication for every platform. |
CVE-2026-59725 | High | 7.5 | — | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. |
CVE-2026-59724 | High | 7.5 | — | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. |
CVE-2026-33151 | High | 7.5 | — | 2026-03-20 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. |
CVE-2024-38355 | High | 7.3 | — | 2024-06-19 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. |
CVE-2020-28481 | Medium | 5.3 | — | 2021-01-19 | The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. |
CVE-2017-16031 | High | 7.5 | — | 2018-06-04 | Socket.io is a realtime application framework that provides communication via websockets. |
All-time worst (top 7 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-69185 | High | 7.5 | — | 2026-08-03 | Socket.IO enables bidirectional and low-latency communication for every platform. |
CVE-2026-59725 | High | 7.5 | — | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. |
CVE-2026-59724 | High | 7.5 | — | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. |
CVE-2026-33151 | High | 7.5 | — | 2026-03-20 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. |
CVE-2017-16031 | High | 7.5 | — | 2018-06-04 | Socket.io is a realtime application framework that provides communication via websockets. |
CVE-2024-38355 | High | 7.3 | — | 2024-06-19 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. |
CVE-2020-28481 | Medium | 5.3 | — | 2021-01-19 | The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. |