Bug 2551068 (CVE-2026-102599)

Summary:	CVE-2026-102599 engine.io: engine.io: Denial of Service via protocol revision mismatch during transport upgrade
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bbrownin, gmalinko, janstey, lchilton, pdelbell, rhel-process-autobot, rstepani, sfeifer, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in engine.io. A remote attacker can cause a Denial of Service (DoS) by establishing a valid session and sending a transport upgrade request with a mismatched or omitted protocol revision parameter. This discrepancy causes the server to attach incompatible communication handlers, allowing a subsequent crafted heartbeat packet to trigger an unhandled error and crash the application process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2555398
Bug Blocks:

Description OSIDB Bzimport 2026-10-13 19:55:06 UTC

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.