CVE-2017-16031: Socket Socket.io

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.

Affected products

• Socket Socket.io: up to and including 0.9.6

Published 2018-06-04. Last modified 2026-06-17.