CVE-2026-102600: Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
This is a prototype pollution / improper client lookup vulnerability in @socket.io/cluster-engine.
Servers using @socket.io/cluster-engine may be impacted when attacker-controlled session IDs are processed in clustered deployments. A malicious client could use special property names such as __proto__, constructor, or other inherited object keys as a session identifier, causing the server to read properties from the object prototype chain instead of only real connected clients.
The impact is denial of service through process crash.
Applications not using @socket.io/cluster-engine are not affected by this specific issue.
Affected versions:
@socket.io/cluster-engine@0.1.0
References
- github.com/advisories/GHSA-wfpm-5gcm-94cg
- github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429
- github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1
- github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg
- nvd.nist.gov/vuln/detail/CVE-2026-102600
Code Behaviors & Features
Detect and mitigate CVE-2026-102600 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →