CVE-2026-102599: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-102599 is a denial-of-service vulnerability in the engine.io npm package (used by Socket.IO) caused by a protocol revision mismatch during WebSocket transport upgrades. The Engine.IO protocol version is negotiated at handshake and stored on the session, but upgrade requests were not validated against the session's negotiated version, allowing a crafted heartbeat packet to trigger an uncaught exception and crash the Node.js process. Affected versions are engine.io >= 6.6.0, < 6.6.10; the issue was fixed in engine.io@6.6.10. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Socket.IO Advisory).

The root cause is classified as CWE-248 (Uncaught Exception): the server failed to verify that the EIO query parameter in a WebSocket upgrade request matched the protocol revision established during the initial handshake. Each transport independently recomputed its protocol revision from the request query, while the session stored its own pinned revision. An attacker could establish a legitimate Engine.IO v4 session and then send a WebSocket upgrade request with a mismatched or omitted EIO parameter; an omitted EIO parameter defaults to protocol v3 on the affected code path, even when v3 compatibility is explicitly disabled. This causes the server to attach a transport using an incompatible parser and heartbeat mode, and a subsequently crafted heartbeat packet can trigger an uncaught exception, terminating the Node.js process. The fix (commit 86db1fc) introduces a computeProtocolRevision() helper and rejects upgrade requests where the derived protocol does not match the session's pinned protocol (Socket.IO Advisory, Fix Commit).

Successful exploitation results in a complete denial of service through an unhandled Node.js process crash, making the affected Socket.IO/Engine.IO server entirely unavailable to legitimate clients. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because a single unauthenticated request sequence can crash the server process, repeated exploitation can prevent service recovery without process supervision or automatic restart mechanisms in place (GitHub Advisory).

No authentication, privileges, or user interaction are required to exploit this vulnerability, and attack complexity is low, making it trivially exploitable by any network-accessible attacker. No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. The vulnerability was reported by researcher sondt99 (Socket.IO Advisory, GitHub Advisory).

1. Identify target: Locate a publicly accessible Node.js server running Socket.IO or Engine.IO with engine.io >= 6.6.0, < 6.6.10 and transport upgrades enabled (the default configuration).
2. Establish a valid session: Send an initial HTTP polling request with EIO=4 to negotiate an Engine.IO v4 session and obtain a session ID (sid):

   GET /engine.io/?transport=polling&EIO=4

3. Send a mismatched upgrade request: Initiate a WebSocket upgrade request using the obtained sid but with a mismatched or omitted EIO parameter (omitting it defaults to v3):

   ws://target/engine.io/?transport=websocket&sid=<SESSION_ID>

   (Note: EIO parameter is omitted or set to 3 while the session was established with EIO=4.)
4. Send a crafted heartbeat packet: Over the newly attached WebSocket transport, send a heartbeat packet formatted according to the v3 protocol. The server, now using an inconsistent parser, encounters an uncaught exception.
5. Process crash achieved: The Node.js process terminates, causing a denial of service for all connected clients. Repeat as needed to prevent recovery (Socket.IO Advisory, Fix Commit).

• Network: Repeated WebSocket upgrade requests to /engine.io/ endpoints with a sid parameter but a missing or mismatched EIO query parameter (e.g., session established with EIO=4 but upgrade sent without EIO or with EIO=3).
• Logs: Engine.IO or Node.js process logs showing connection_error events with code: 3 (Bad Request) and context.name: PROTOCOL_MISMATCH; uncaught exception stack traces in Node.js stdout/stderr immediately before process exit.
• Process: Unexpected Node.js process crashes or restarts (e.g., PM2, systemd, or Docker restart logs) correlated with WebSocket upgrade activity; absence of graceful shutdown signals preceding the crash.
• Application: Sudden drop in active Socket.IO connections followed by a server restart event, particularly when no application-level errors were logged prior to the crash (Socket.IO Advisory, Fix Commit).

The primary fix is to upgrade engine.io to version 6.6.10 or later; Socket.IO users should update to a Socket.IO release that bundles the patched Engine.IO version (Release Notes). If immediate upgrade is not possible, two workarounds are available: (1) disable transport upgrades entirely with allowUpgrades: false, or (2) restrict to a single transport such as WebSocket-only (transports: ["websocket"]) — both avoid the vulnerable upgrade code path but may affect client compatibility. As an additional proxy-layer mitigation, deployments can reject Engine.IO requests for an existing sid when the EIO parameter is missing or does not match the session's negotiated protocol (Socket.IO Advisory).

The advisory was published by Socket.IO maintainer darrachequesne on September 14, 2026, and added to the GitHub Advisory Database on September 29, 2026. The release of engine.io@6.6.10 received positive reactions from the community on GitHub. No significant broader media coverage or notable independent researcher commentary has been identified beyond the official advisory (GitHub Advisory, Release Notes).