AIKIDO-2026-552774

TL;DR

The Socket.IO common parser buffers binary attachment data per connection without enforcing limits on the declared attachment count or the total accumulated bytes. A remote unauthenticated client can send a small text frame that declares a lot of expected binary attachments and then stream binary frames that keep accumulating in per-connection memory. Because the count and accumulated size are never capped, a few concurrent connections can exhaust server memory and cause a crash. The fix introduces parse configuration limits that reject excessive attachment counts and cap accumulated binary bytes.