CVE-2026-102600

Name of the Vulnerable Software and Affected Versions @socket.io/cluster-engine versions prior to 0.1.1

Description In clustered deployments, the software uses inherited object properties when looking up session IDs controlled by an attacker. By using special property names like proto or constructor, the lookup can resolve through the object prototype chain instead of identifying a connected client. This leads to a crash of the Node.js process, resulting in a denial of service. This issue only affects applications utilizing the @socket.io/cluster-engine module.

Recommendations Update to version 0.1.1.