CVE-2026-59724
HighSocket.IO enables bidirectional and low-latency communication for every platform.
Published Jul 8, 2026 · Updated Sep 15, 2026 · Also known as EUVD-2026-42312, GHSA-gr94-w7qr-f4j3, ROOT-APP-NPM-CVE-2026-59724
Key Facts
Patch in the next maintenance window- CVE-2026-59724 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Engine.io (Socket), jupyter-base-notebook (chainguard), tensorflow-gpu-jupyter (chainguard) and 6 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including @rootio/engine.io 6.5.4-root.io.2, @seal-security/engine.io 6.6.4-sp999, dotnet8 0-main-8.0.128-1.hum1.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
0.6%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-59724 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as proto through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.
Affected Products
13 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Engine.ioSocket | >= 6.5.0 | 6.6.7 |
| jupyter-base-notebookchainguard | See advisory | 7.6.3-r2 |
| tensorflow-gpu-jupyterchainguard | See advisory | 2.21.0-r9 |
| gristminimos | See advisory | 1.7.18-r0 |
| trigger-devminimos | See advisory | 4.5.12-r0 |
Patched Releases
@rootio/engine.io
6.5.4-root.io.2
@seal-security/engine.io
6.6.4-sp999
dotnet8
0-main-8.0.128-1.hum1
Engine.io
6.5.4-aikido.2, 6.6.4-sp999, 6.6.7
grist
1.7.18-r0
jupyter-base-notebook
7.6.3-r2
socket.io
6.6.7
tensorflow-gpu-jupyter
2.21.0-r9
trigger-dev
4.5.12-r0
Timeline
Publicly disclosed
Jul 8, 2026
Last updated
Sep 15, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
References
- advisoryRHSA-2026:26994
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59724.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-59724
- otherhttps://github.com/socketio/socket.io
FAQ
Common Questions.
Socket.IO enables bidirectional and low-latency communication for every platform.
Affected: Engine.io (Socket) versions >= 6.5.0; jupyter-base-notebook (chainguard); tensorflow-gpu-jupyter (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including @rootio/engine.io 6.5.4-root.io.2, @seal-security/engine.io 6.6.4-sp999, dotnet8 0-main-8.0.128-1.hum1.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-59724 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo