How Denial of Service via Invalid Binary POST Requests happens in Socket.IO and how to fix it

Introduction

In a Node.js application using Socket.IO for real-time communication, a high-severity vulnerability was discovered in the package-lock.json dependency tree. The engine.io package version 6.6.5—the transport layer that powers Socket.IO connections—contained a critical flaw where malformed binary POST requests could crash the entire server. This wasn't a theoretical risk: any attacker with network access could send specially crafted binary packets to bring down real-time communication channels, affecting all connected users simultaneously.

The vulnerability, tracked as CVE-2026-59725, was flagged by Trivy's static analysis scanner and required an immediate upgrade from engine.io 6.6.5 to 6.6.7. The fix involved not just updating the version number in package-lock.json, but also adding the @types/ws dependency and implementing an override in package.json to ensure the secure version propagates through the entire dependency tree.

The Vulnerability Explained

Engine.io serves as the low-level transport layer for Socket.IO, handling WebSocket connections, HTTP long-polling, and binary data transmission. In version 6.6.5, the binary POST request handler lacked sufficient validation for malformed packet structures. When a client sent a binary POST with an invalid format—such as incorrect length headers, malformed base64 encoding, or corrupted packet boundaries—the parser would fail catastrophically rather than gracefully rejecting the request.

Here's what the vulnerable dependency looked like in package-lock.json:

"node_modules/engine.io": {
  "version": "6.6.5",
  "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.5.tgz",
  "integrity": "sha512-2RZdgEbXmp5+dVbRm0P7HQUImZpICccJy7rN7Tv+SFa55pH+lxnuw6/K1ZxxBfHoYpSkHLAO92oa8O4SwFXA2A==",
  "license": "MIT",
  "dependencies": {
    "@types/cors": "^2.8.12",
    "@types/node": ">=10.0.0",
    "accepts": "~1.3.4",
    "base64id": "2.0.0",
    "cookie": "~0.7.2",
    ...
  }
}

The Attack Scenario

Consider a real-time chat application or collaborative editing tool using Socket.IO. An attacker could exploit this vulnerability through the following steps:

1. Establish a connection: The attacker connects to the Socket.IO endpoint using a standard WebSocket client or HTTP long-polling.

2. Craft a malformed binary packet: Instead of sending properly formatted binary data, the attacker constructs a POST request with:
   - Invalid packet type markers
   - Corrupted length prefixes that don't match actual payload size
   - Malformed UTF-8 or base64-encoded binary data
   - Boundary violations in multi-part binary messages

3. Send the payload: The attacker sends this malformed binary POST to the engine.io endpoint (typically /socket.io/?EIO=4&transport=polling).

4. Server crash: Engine.io 6.6.5's binary parser attempts to process the invalid packet, encounters an unhandled exception or enters an infinite loop, and either crashes the Node.js process or hangs indefinitely.

5. Service disruption: All connected clients lose their real-time connections. In a production environment with hundreds or thousands of concurrent users, this single malformed request brings down the entire real-time communication infrastructure.

The real-world impact is severe: imagine a stock trading platform where real-time price updates stop, a multiplayer game where all players disconnect simultaneously, or a telemedicine application where doctor-patient video consultations abruptly terminate. The attacker doesn't need authentication, special privileges, or complex exploit chains—just the ability to send a single malformed HTTP POST request.

The Fix

The security team addressed CVE-2026-59725 by upgrading engine.io from version 6.6.5 to 6.6.7, which includes hardened binary packet validation. The fix required changes to two files: package-lock.json and package.json.

Before the Fix

The vulnerable dependency specification in package-lock.json:

"node_modules/engine.io": {
  "version": "6.6.5",
  "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.5.tgz",
  "integrity": "sha512-2RZdgEbXmp5+dVbRm0P7HQUImZpICccJy7rN7Tv+SFa55pH+lxnuw6/K1ZxxBfHoYpSkHLAO92oa8O4SwFXA2A==",
  "dependencies": {
    "@types/cors": "^2.8.12",
    "@types/node": ">=10.0.0",
    "accepts": "~1.3.4",
    ...
  }
}

The package.json overrides section only contained:

"overrides": {
  "form-data": "4.0.6"
}

After the Fix

The patched version in package-lock.json:

"node_modules/engine.io": {
  "version": "6.6.7",
  "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.7.tgz",
  "integrity": "sha512-DgOngfDKM2EviOH3Mr9m7ks1q8roetLy/IMmYthAYzbpInMbYc/GS+fWFA3rl1gvwKVsQrVV61fo5emD1y3OJQ==",
  "dependencies": {
    "@types/cors": "^2.8.12",
    "@types/node": ">=10.0.0",
    "@types/ws": "^8.5.12",  // NEW: WebSocket type definitions added
    "accepts": "~1.3.4",
    ...
  }
}

The updated package.json with explicit override:

"overrides": {
  "form-data": "4.0.6",
  "engine.io": "6.6.7"  // NEW: Force all dependencies to use secure version
}

How This Specific Change Solves the Problem

The upgrade to engine.io 6.6.7 introduces several critical security improvements:

1. Enhanced binary packet validation: The new version adds strict format checking before attempting to parse binary POST data, immediately rejecting packets with invalid headers, incorrect length prefixes, or malformed encoding.

2. WebSocket type safety: The addition of @types/ws dependency provides stronger TypeScript type definitions for WebSocket handling, enabling compile-time detection of unsafe binary data operations.

3. Dependency override enforcement: The package.json override ensures that even if other dependencies in the tree require older engine.io versions, npm will force the use of 6.6.7 throughout the entire dependency graph, preventing version downgrade attacks.

4. Graceful error handling: Instead of crashing on invalid input, version 6.6.7 logs the malformed request, closes the problematic connection, and continues serving other clients without interruption.

The fix preserves all valid binary data transmission functionality while hardening the parser against malicious input. Applications using Socket.IO for file uploads, image sharing, or other binary data features will continue to work exactly as before—but now they're protected against DoS attacks through malformed packets.

Key Takeaways

• Engine.io 6.6.5's binary POST handler lacked validation: The vulnerability existed in the transport layer's packet parser, not in application code, demonstrating the importance of monitoring transitive dependencies.

• A single malformed binary packet could crash the entire Socket.IO server: Unlike traditional DoS attacks requiring high request volumes, this vulnerability could be exploited with minimal bandwidth and a single crafted payload.

• Dependency overrides in package.json are critical for security: Simply updating package-lock.json isn't enough—the override ensures that all packages in the dependency tree use the patched version, preventing version conflicts.

• CVE-2026-59725 required both version upgrade and new type definitions: The fix added @types/ws to improve WebSocket handling type safety, showing that security patches often involve more than just bug fixes.

• Real-time communication libraries require special DoS protection: Applications using Socket.IO, WebSockets, or Server-Sent Events need additional layers of rate limiting and input validation beyond what HTTP services typically require.

How Orbis AppSec Detected This

• Source: Binary data in HTTP POST requests to Socket.IO endpoints via the engine.io transport layer
• Sink: Binary packet parser in engine.io version 6.6.5, specifically the handler for malformed binary POST data that lacks proper format validation
• Missing control: Input validation for binary packet structure, length verification, and error handling for corrupted or malicious binary payloads
• CWE: CWE-400 (Uncontrolled Resource Consumption)
• Fix: Upgraded engine.io from 6.6.5 to 6.6.7 with enhanced binary packet validation and added @types/ws dependency for improved type safety

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-59725 demonstrates that even mature, widely-used libraries like engine.io can harbor critical vulnerabilities in their input handling logic. The Denial of Service attack vector through malformed binary POST requests was particularly dangerous because it required minimal attacker sophistication while causing maximum disruption to real-time communication services.

The fix—upgrading from engine.io 6.6.5 to 6.6.7 and implementing dependency overrides—provides immediate protection against this attack vector. However, the broader lesson is clear: applications using real-time communication libraries must maintain vigilant dependency management, implement defense-in-depth strategies with rate limiting and input validation, and continuously monitor for security advisories affecting their WebSocket and Socket.IO infrastructure.

For development teams building real-time features, this vulnerability underscores the importance of treating binary data transmission with the same security rigor as traditional HTTP endpoints. Every binary packet, every WebSocket message, and every long-polling request represents a potential attack surface that requires validation, sanitization, and resource limits.