A prototype‑pollution flaw in the @socket.io/cluster‑engine library allows an attacker to supply a crafted session identifier containing special property names such as __proto__ or constructor. When the engine attempts to associate that identifier with a connected client inside a clustered deployment, the lookup follows the prototype chain instead of matching a real session, causing the Node.js process to crash. The crash terminates the server, producing a denial‑of‑service condition for all users.

The vulnerability affects the @socket.io/cluster‑engine component bundled with socket.io. All versions of @socket.io/cluster‑engine released before 0.1.1 are vulnerable, regardless of the surrounding socket.io version, as long as the component is used in a clustered deployment.

The flaw carries a CVSS score of 7.5. No public EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be able to communicate with the socket.io server and send a crafted session identifier, a condition that is typically satisfied by any remote client or malicious actor inside the network. Successful exploitation will crash the process, denying service until the application is restarted.