Ni8Walk3R

**Name of the Vulnerable Software and Affected Versions** Socket.IO versions 6.5.0 through 6.6.6 **Description** Engine.IO servers with WebTransport enabled are susceptible to a denial of service. During WebTransport upgrade handling, the server can resolve a crafted session ID, such as ` proto `, through an inherited property of the clients object, which results in a TypeError. **Recommendations** Update to version 6.6.7.

Name of the Vulnerable Software and Affected Versions: socket.io versions prior to 2.4.0 Description: The issue is related to Insecure Defaults due to CORS Misconfiguration, where all domains are whitelisted by default. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting CORS configuration to only allow specific domains.