CVE-2026-102600

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

• CWE-20
• CWE-1321

• https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
• https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1
• https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10257A security flaw has been discovered in itsourcecode Content …6.3
• CVE-2026-102570ClipBucket v5 through 5.5.3-#197 contains a time-based blind…5.5
• CVE-2026-10258A weakness has been identified in itsourcecode Content Manag…6.3
• CVE-2026-10259A security vulnerability has been detected in H3C Magic B0 u…8.8
• CVE-2026-102598Werkzeug is a comprehensive WSGI web application library. Pr…6.3
• CVE-2026-10260A vulnerability was detected in CodeAstro Online Job Portal …7.3
• CVE-2026-102601Flysystem is an open source file storage library for PHP. Pr…3.5
• CVE-2026-10261A flaw has been found in CodeAstro Online Job Portal 1.0. Th…7.3
• CVE-2026-10262A vulnerability has been found in code-projects Real State S…7.3
• CVE-2026-102623A flaw was found in KubeVirt. An authenticated user with per…6.5
• CVE-2026-10263A vulnerability was found in SourceCodester Computer Repair …7.3
• CVE-2026-102630UnoPim versions before 2.0.1 and 2.1.1 trust all connecting …4.7