THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-59724 (HIGH 7.5) — Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrad

[NVD] CVE-2026-59724 (HIGH 7.5) — Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as proto through an inherited property of the clients object during WebTransport upgrad

mednvdPublished 2026-07-08

CVE-2026-59724 CVSS: 7.5 HIGH Published: 2026-07-08T16:16:32.980

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service.

Indicators of compromise

CVE-2026-59724cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59724