Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to     versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a     large number of binary attachments and buffer them, which can be exploited to make the server run out of     memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6. (CVE-2026-33151)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to
    versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a
    large number of binary attachments and buffer them, which can be exploited to make the server run out of
    memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6. (CVE-2026-33151)

ID	Name	Product	Family	Severity
303255	Linux Distros Unpatched Vulnerability : CVE-2026-33151	Nessus	Misc.	high
438929	SCA: security update for socket.io-parser (GHSA-677m-j7p3-52f9)	Tenable Cloud Security	SCA Checks	high
438929	SCA: security update for socket.io-parser (GHSA-677m-j7p3-52f9)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-33151

high

Tenable Plugins

high

high

high