{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/socket.io/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:socket:engine.io:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59725"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["engine.io (\u003e= 4.1.0, \u003c 6.6.7)","Socket.IO"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["Socket.IO"],"content_html":"\u003cp\u003eA critical denial-of-service vulnerability, identified as CVE-2026-59725, affects \u003ccode\u003eengine.io\u003c/code\u003e versions 4.1.0 through 6.6.6. \u003ccode\u003eengine.io\u003c/code\u003e is a core dependency of the widely used Socket.IO framework. This flaw enables an unauthenticated remote attacker to trigger resource exhaustion on a vulnerable server by sending specially crafted binary \u003ccode\u003ePOST\u003c/code\u003e requests. Specifically, by targeting an Engine.IO protocol v4 polling transport with \u003ccode\u003eContent-Type: application/octet-stream\u003c/code\u003e and an invalid request body, the server reports a transport error but crucially fails to properly close the associated HTTP response. This leaves the underlying HTTP connection open, consuming a server-side socket or file descriptor. Repeated execution of this technique can exhaust the server's available HTTP connections, sockets, and other resources, ultimately preventing legitimate clients from connecting and resulting in a denial of service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker identifies a public-facing web application that utilizes \u003ccode\u003eengine.io\u003c/code\u003e for its Engine.IO protocol v4 polling transports.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP \u003ccode\u003ePOST\u003c/code\u003e request specifically designed to interact with the Engine.IO polling endpoint (e.g., \u003ccode\u003e/engine.io/?EIO=4\u0026amp;transport=polling\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eContent-Type\u003c/code\u003e header of this \u003ccode\u003ePOST\u003c/code\u003e request is set to \u003ccode\u003eapplication/octet-stream\u003c/code\u003e, and the request body contains malformed or invalid binary data.\u003c/li\u003e\n\u003cli\u003eThe attacker sends this malformed \u003ccode\u003ePOST\u003c/code\u003e request to the vulnerable \u003ccode\u003eengine.io\u003c/code\u003e server instance.\u003c/li\u003e\n\u003cli\u003eUpon receiving the request, the \u003ccode\u003eengine.io\u003c/code\u003e server processes the malformed binary data, resulting in a transport error.\u003c/li\u003e\n\u003cli\u003eDespite the error, the vulnerable server fails to properly close the HTTP response and the underlying HTTP connection associated with the request.\u003c/li\u003e\n\u003cli\u003eThis unclosed connection consumes one of the server's limited resources, such as an HTTP connection, socket, or file descriptor.\u003c/li\u003e\n\u003cli\u003eThe attacker repeats steps 2-7 multiple times, progressively exhausting the server's resources and ultimately leading to a Denial of Service condition that prevents legitimate users from connecting.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-59725 results in a Denial of Service (DoS) for the affected \u003ccode\u003eengine.io\u003c/code\u003e or Socket.IO application. Attackers can exhaust critical server resources, including HTTP connections, network sockets, and file descriptors. This resource depletion prevents legitimate users and clients from establishing new connections or interacting with the application, rendering the service unavailable. The impact can extend to any web application or service that relies on vulnerable \u003ccode\u003eengine.io\u003c/code\u003e versions, potentially affecting a broad range of sectors using Node.js-based web communication frameworks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of \u003ccode\u003eengine.io\u003c/code\u003e to version \u003ccode\u003e6.6.7\u003c/code\u003e or later immediately to patch CVE-2026-59725.\u003c/li\u003e\n\u003cli\u003eDeploy the \u003ccode\u003eDetects CVE-2026-59725 Exploitation - Engine.IO DoS Attempt\u003c/code\u003e Sigma rule to your SIEM to detect attempts to exploit this vulnerability.\u003c/li\u003e\n\u003cli\u003eConfigure reverse proxies, load balancers, or Web Application Firewalls (WAFs) to block or reject \u003ccode\u003ePOST\u003c/code\u003e requests with \u003ccode\u003eContent-Type: application/octet-stream\u003c/code\u003e targeting Engine.IO protocol v4 endpoints, as described in the \u003ccode\u003eworkarounds\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eImplement per-IP rate limits and connection limits for Engine.IO endpoints at the network edge to mitigate the impact of repeated requests.\u003c/li\u003e\n\u003cli\u003eEnforce strict request and connection timeouts at your HTTP server, reverse proxy, or load balancer to ensure idle or problematic connections are terminated promptly.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:53:08Z","date_published":"2026-07-20T21:53:08Z","id":"https://feed.craftedsignal.io/briefs/2026-07-engineio-dos/","summary":"An unauthenticated remote attacker can cause a denial of service in `engine.io` by sending invalid binary POST requests with `Content-Type: application/octet-stream` to Engine.IO protocol v4 polling transports, leading to exhaustion of server-side resources such as HTTP connections, sockets, and file descriptors due to improper connection closure.","title":"Engine.IO Polling Transport Connection Exhaustion Vulnerability (CVE-2026-59725)","url":"https://feed.craftedsignal.io/briefs/2026-07-engineio-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Socket.IO","version":"https://jsonfeed.org/version/1.1"}