{"vulnerability": "cve-2026-102600", "sightings": [{"uuid": "f0a5eafa-d31a-453b-a8b5-4c0fbf11c7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102600", "type": "seen", "source": "https://gist.github.com/alon710/1c79e854fe7a3bbbdcc0d94fbbb33c33", "content": "# CVE-2026-102600: CVE-2026-102600: Unhandled Runtime Exception via Unsafe Prototype Lookup in @socket.io/cluster-engine\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102600\n\n## Summary\nA critical Denial of Service (DoS) vulnerability exists in @socket.io/cluster-engine before version 0.1.1. Unauthenticated remote attackers can crash the server process by supplying inherited prototype property names as session identifiers.\n\n## TL;DR\nUnauthenticated remote attackers can trigger a Node.js process crash and Denial of Service in @socket.io/cluster-engine by passing prototype-inherited properties as session IDs.\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00366 (Percentile: 28.17%)\n- **Impact**: Denial of Service\n- **Exploit Status**: None\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- @socket.io/cluster-engine\n- **@socket.io/cluster-engine**: < 0.1.1 (Fixed in: `0.1.1`)\n\n## Mitigation\n\n- Upgrade @socket.io/cluster-engine to version 0.1.1 or higher.\n- Deploy WAF rules to block incoming queries containing prototype pollution payloads on Socket.IO paths.\n- Initialize lookup maps using Object.create(null) to prevent dynamic prototype resolving.\n\n**Remediation Steps:**\n1. Navigate to the project directory containing the affected package.\n2. Execute the update command: npm install @socket.io/cluster-engine@0.1.1\n3. Validate the node_modules structure to ensure older versions are purged.\n4. Restart the clustered server process to apply the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-wfpm-5gcm-94cg](https://github.com/socketio/socket.io/security/advisories/GHSA-wfpm-5gcm-94cg)\n- [Official Fix Commit](https://github.com/socketio/socket.io/commit/830e3642ebb8dc3784eb749b0a004fe2b932b429)\n- [Release Tag @socket.io/cluster-engine@0.1.1](https://github.com/socketio/socket.io/releases/tag/@socket.io/cluster-engine@0.1.1)\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-102600)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-102600)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102600) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T11:30:31.000000Z"}]}