Engine.IO WebTransport Denial of Service

The Engine.IO library, a core component for real-time communication in Socket.IO applications, contains a denial of service (DoS) vulnerability (CVE-2026-59724) affecting deployments where WebTransport support is explicitly enabled. The vulnerability stems from improper validation of session ID lookups in the WebTransport upgrade handshake. An unauthenticated remote attacker can submit a crafted upgrade request with a session ID value like "proto". Because the server fails to verify that the key is an own property of the clients object, the lookup resolves to an inherited prototype property, triggering a TypeError. This error, occurring in an asynchronous context, leads to an unhandled Promise rejection that terminates the Node.js process. This vulnerability affects Engine.IO versions 6.5.0 up to 6.6.6. Defenders should prioritize upgrading to version 6.6.7 or disabling WebTransport support if the immediate upgrade is not feasible.

Impact

Successful exploitation results in the immediate termination of the Engine.IO server process. In production environments without robust process supervision, this causes a total loss of service. If a process supervisor is present, repeated exploitation by an attacker will result in continuous crash loops, effectively preventing service availability for legitimate users. This threat specifically targets web applications using the Node.js ecosystem and real-time Socket.IO communication.

Recommendation

• Upgrade the Engine.IO dependency to version 6.6.7 or later to patch CVE-2026-59724.
• If upgrading is delayed, immediately modify the Engine.IO configuration to remove "webtransport" from the enabled transports list.
• Monitor server logs for repeated process crashes or unusual WebTransport upgrade requests containing prototype manipulation keys.
• Inspect HTTP/3 and WebTransport gateway traffic at the reverse proxy layer for anomalous session ID formatting.