CVE-2026-102599
Description
A flaw was found in engine.io. A remote attacker can cause a Denial of Service (DoS) by establishing a valid session and sending a transport upgrade request with a mismatched or omitted protocol revision parameter. This discrepancy causes the server to attach incompatible communication handlers, allowing a subsequent crafted heartbeat packet to trigger an unhandled error and crash the application process.
Statement
A flaw of IMPORTANT impact was found in the Engine.IO transport layer of Socket.IO. A remote, unauthenticated attacker can establish a valid Engine.IO session and then send a transport upgrade request with a mismatched or omitted EIO protocol revision parameter. Because the server derives the protocol revision for the upgrade from the request rather than enforcing the revision negotiated for the existing session, a transport with incompatible parser and heartbeat behavior is attached, and a subsequently crafted heartbeat packet can trigger an uncaught exception that terminates the Node.js process, causing a denial of service with no impact on confidentiality or integrity. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted EIO value is interpreted as protocol revision 3 on the affected path. Within the Red Hat portfolio, only the community-supported qt6-qtwebengine package in EPEL is affected, and a fix is being pursued for it; Red Hat-managed products, including Red Hat Enterprise Linux, RHEL AI, Red Hat In-Vehicle OS, Red Hat JBoss Fuse, and Red Hat Hardened Images, are not affected because the vulnerable code is not present in the shipped versions of those components. The Red Hat severity of IMPORTANT matches the upstream assessment.
Mitigation
Upgrading to an engine.io release that contains the fix (engine.io 6.6.10 or later, or a Socket.IO release that bundles it) is the recommended resolution. Where upgrading is not immediately possible, upstream documents workarounds that avoid the vulnerable transport-upgrade path: disable transport upgrades by setting allowUpgrades: false in the Socket.IO server options, or restrict the server to a single transport such as WebSocket-only via transports: ["websocket"]. Note that these options may affect client compatibility and connection behavior. As an additional temporary measure, deployments can reject Engine.IO requests for an existing session (sid) when the EIO query parameter is missing or does not match the protocol revision negotiated during the initial handshake; this is best implemented at the application proxy or middleware layer and only if the deployment can reliably track each session's negotiated protocol.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
