Socket.IO’s Engine.IO component allows WebTransport sessions to be upgraded using a session ID supplied by the client. Between versions 6.5.0 and 6.6.6 the upgrade routine resolves the supplied ID against an internal clients object without validating that the identifier is a safe property name. If an attacker supplies a crafted value such as "__proto__", the lookup triggers a TypeError, crashing the upgrade handling and causing a denial of service. The flaw is an input validation weakness (CWE‑20) and a type confusion issue (CWE‑843).

The vulnerability affects Socket.IO Engine.IO servers configured with WebTransport enabled and running versions between 6.5.0 and 6.6.6 inclusive. The fix was introduced in Engine.IO version 6.6.7, so any installation of 6.6.7 or newer is not affected. The problem resides exclusively in the server side; client‑side components are not impacted.

The CVSS score of 7.5 indicates high severity, while an EPSS score of less than 1% suggests a very low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it remotely by sending a WebTransport upgrade request containing a malicious session identifier such as "__proto__", which causes the server to throw an exception and drop the connection. Because the defect lies in the server’s internal state handling, repeated attacks can result in service interruption until the vulnerable code path is removed.