Skip to content

Vendor

Socket vulnerabilities

3 published CVES affecting Socket, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
2
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of Socket alerts

Products

Latest Socket CVEs

Newest publication first

  1. CVE-2026-90651 Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration k...

    Published
    HighCVSS 8.1

    Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL...

  2. CVE-2017-16031 Insecure randomness in socket.io

    Published
    HighCVSS 7.5 EPSS 2.0%

    Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random() to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, p...

  3. CVE-2016-10536 Insecure Defaults Allow MITM Over TLS in engine.io-client

    Published
    MediumCVSS 5.9

    engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is somethin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.