Socket.IO, a library used for real‑time bidirectional communication, contains a flaw that allows an attacker to send an exploit packet with an unusually large number of binary attachments. The server will allocate memory to buffer each attachment, causing it to exhaust system memory and potentially crash or become unresponsive. The weakness stems from insufficient input validation (CWE‑20), improper handling of large data sets (CWE‑754), and memory management errors (CWE‑770).

This flaw affects Socket.IO versions older than 4.2.7, 3.4.5, and 3.3.6. Any deployment that continues to use one of those legacy releases is vulnerable. The vulnerability is present in the main Socket.IO library and does not require additional plugins.

The CVSS base score of 7.5 indicates a high impact level, while the EPSS score of less than 1% suggests that the likelihood of exploitation is low. It is also not listed in the CISA KEV catalog, indicating no known widespread active exploitation. The attack vector would be a network‑based, unauthenticated client that initiates a Socket.IO connection and sends a malicious packet with many binary attachments, causing the server to run out of memory and become unresponsive, which affects the availability of the affected service.