The vulnerability allows an attacker to initiate a transport upgrade that derives a different Engine.IO protocol revision than the one stored in the existing session. By sending a crafted upgrade request and a specially designed heartbeat packet, the malicious client can trigger an uncaught exception and terminate the Node.js process. This results in a denial of service to all clients connected to the affected Socket.IO instance.

Socket.IO Engine.IO library versions 6.6.0 through 6.6.10 are impacted. The flaw applies to deployments that use any transport upgrade path without enforcing the stored protocol revision.

The CVSS score of 7.5 indicates moderate risk, while the EPSS score is unavailable, providing no clear evidence of high exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a remote client able to communicate over the network and send crafted upgrade requests, which is inferred from the nature of the vulnerability. If exploited, the attacker can bring the Node.js process down, causing interruption of service for all users.