How many socketio engine.io CVEs are in CISA KEV?

None of socketio engine.io's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for socketio engine.io vulnerabilities?

Yes — 1 of socketio engine.io's CVEs have a known public exploit.

Which versions of socketio engine.io are affected?

152 distinct socketio engine.io versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in socketio engine.io CVEs?

socketio engine.io's CVEs most often map to these CWE weakness types: CWE-248 (Uncaught Exception), CWE-404 (Improper Resource Shutdown or Release), CWE-754 (Improper Check for Unusual or Exceptional Conditions).

What is the average severity of socketio engine.io CVEs?

The average CVSS base score across socketio engine.io's scored CVEs is 7.2.

socketio

5 CVEs

npm

socketio engine.io Vulnerabilities

Name: socketio engine.io vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for engine.io by socketio.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.2

Avg CVSS

2021–2026

Last updated July 8, 2026

Overview

socketio engine.io has 5 published CVE records since 2021, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting socketio engine.io, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of socketio engine.io's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High4

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of socketio engine.io's CVEs are currently listed in CISA's KEV catalog.

Public exploits

One of socketio engine.io's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every socketio engine.io version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

5.1.03 CVEs
5.1.13 CVEs
5.2.03 CVEs
6.0.03 CVEs
6.1.03 CVEs
0.1.02 CVEs
0.1.12 CVEs
0.1.22 CVEs
0.2.02 CVEs
0.2.12 CVEs
0.2.22 CVEs
0.3.02 CVEs
0.3.12 CVEs
0.3.102 CVEs
0.3.22 CVEs
0.3.32 CVEs
0.3.42 CVEs
0.3.52 CVEs
0.3.72 CVEs
0.3.82 CVEs
0.3.92 CVEs
0.4.12 CVEs
0.4.22 CVEs
0.4.32 CVEs
0.5.02 CVEs
0.6.02 CVEs
0.6.12 CVEs
0.6.22 CVEs
0.6.32 CVEs
0.7.02 CVEs
0.7.12 CVEs
0.7.102 CVEs
0.7.112 CVEs
0.7.122 CVEs
0.7.132 CVEs
0.7.142 CVEs
0.7.22 CVEs
0.7.32 CVEs
0.7.42 CVEs
0.7.52 CVEs
0.7.62 CVEs
0.7.72 CVEs
0.7.82 CVEs
0.7.92 CVEs
0.8.02 CVEs
0.8.12 CVEs
0.8.22 CVEs
0.9.02 CVEs
1.0.02 CVEs
1.0.12 CVEs
1.0.22 CVEs
1.0.32 CVEs
1.0.42 CVEs
1.0.52 CVEs
1.1.02 CVEs
1.1.12 CVEs
1.2.02 CVEs
1.2.12 CVEs
1.2.22 CVEs
1.3.02 CVEs
1.3.12 CVEs
1.4.02 CVEs
1.4.12 CVEs
1.4.22 CVEs
1.4.32 CVEs
1.5.02 CVEs
1.5.12 CVEs
1.6.02 CVEs
1.6.12 CVEs
1.6.22 CVEs
1.6.32 CVEs
1.6.42 CVEs
1.6.52 CVEs
1.6.62 CVEs
1.6.72 CVEs
1.6.82 CVEs
1.7.02 CVEs
1.7.12 CVEs
1.7.22 CVEs
1.8.02 CVEs
1.8.12 CVEs
1.8.22 CVEs
2.0.02 CVEs
2.0.12 CVEs
2.0.22 CVEs
2.1.02 CVEs
3.0.02 CVEs
3.1.02 CVEs
3.1.12 CVEs
3.1.22 CVEs
3.1.32 CVEs
3.2.02 CVEs
3.2.12 CVEs
3.3.02 CVEs
3.3.12 CVEs
3.3.22 CVEs
3.4.02 CVEs
4.0.02 CVEs
4.0.12 CVEs
4.0.22 CVEs
4.0.32 CVEs
4.0.42 CVEs
4.0.52 CVEs
4.0.62 CVEs
4.1.02 CVEs
4.1.12 CVEs
5.0.02 CVEs
6.1.12 CVEs
6.1.22 CVEs
6.1.32 CVEs
6.2.02 CVEs
< 3.6.11 CVE
>= 4.0.0, < 4.1.21 CVE
>= 4.0.0, < 6.2.11 CVE
>= 5.0.0, < 5.2.11 CVE
>= 6.0.0, < 6.1.11 CVE
3.4.11 CVE
3.4.21 CVE
3.5.01 CVE
3.6.01 CVE
4.0.0-alpha.01 CVE
4.0.0-alpha.11 CVE
6.2.11 CVE
6.3.01 CVE
6.3.11 CVE
6.4.01 CVE
6.4.11 CVE

Version ranges

< 3.6.01 CVE
< 3.6.11 CVE
>= 5.1.0, < 6.4.21 CVE
4.0.0 <= v < 4.1.21 CVE
4.0.0 <= v < 6.2.11 CVE
4.1.0 <= v < 6.6.71 CVE
5.0.0 <= v < 5.2.11 CVE
5.1.0 <= v < 6.4.21 CVE
6.0.0 <= v < 6.1.11 CVE

Fixed in

24b847be6a61b64efc8c8c4d058a69259ad676931 CVE
3.6.01 CVE
3.6.11 CVE
4.1.21 CVE
5.2.11 CVE
6.1.11 CVE
6.2.11 CVE
6.4.21 CVE
6.6.71 CVE
67a3a8785900f77d8ad40c3c1eea8ee188c42d951 CVE
70b1c36be112671b690736de1a24753e8ec5ba221 CVE
734f9d1268840722c41219e69eb58318e0b2ac6b1 CVE
95e215387c589025dde3982865bf8c862d0494691 CVE
c6315af44826b87f6802574f1ef79dfa63777fab1 CVE
d36199cfe03caac96f5e84326561e9ccd460df1e1 CVE
f3b761dc560e6cd045ef42939dc28d7138f245e91 CVE

Find a version

5 CVEs

Sort

Socket.IO: Engine.IO Polling Transport Connection Exhaustion
CVE-2026-59725
Patch
CWE-404
High · CVSS 7.5
EPSS 0.4% (28th pct)2026-07-08
Medium vulnerability · 2023-05-08
CVE-2023-31125
Patch
CWE-248
Medium · CVSS 6.5
EPSS 1.3% (68th pct)2023-05-08
High vulnerability · 2022-11-22
CVE-2022-41940
Public exploit
Patch
CWE-248
High · CVSS 7.1
EPSS 1.9% (78th pct)2022-11-22
High vulnerability · 2022-01-12
CVE-2022-21676
Patch
CWE-754
High · CVSS 7.5
EPSS 2.8% (85th pct)2022-01-12
High vulnerability · 2021-01-07
CVE-2020-36048
Patch
High · CVSS 7.5
EPSS 3.2% (87th pct)2021-01-07

Common weakness types

The CWE weakness categories most often found in socketio engine.io CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many socketio engine.io CVEs were published each year.

2021

2022

2023

2026

Other socketio products

Browse vulnerabilities for other products by socketio.

socket.io6 CVEs socket.io-parser4 CVEs engine.io-client1 CVEs io.socket:socket.io-client1 CVEs socket.io-client-java1 CVEs

All socketio vulnerabilities

Frequently asked questions

Common questions about socketio engine.io vulnerabilities.

How many CVEs does socketio engine.io have?: socketio engine.io has 5 published CVE records since 2021.
How many socketio engine.io CVEs are in CISA KEV?: None of socketio engine.io's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for socketio engine.io vulnerabilities?: Yes — 1 of socketio engine.io's CVEs have a known public exploit.
Which versions of socketio engine.io are affected?: 152 distinct socketio engine.io versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in socketio engine.io CVEs?: socketio engine.io's CVEs most often map to these CWE weakness types: CWE-248 (Uncaught Exception), CWE-404 (Improper Resource Shutdown or Release), CWE-754 (Improper Check for Unusual or Exceptional Conditions).
What is the average severity of socketio engine.io CVEs?: The average CVSS base score across socketio engine.io's scored CVEs is 7.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track socketio engine.io vulnerabilities

Monitor new socketio engine.io vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing