CVE-2026-103936
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-248, CWE-755
Impact
Remote, unauthenticated attackers can crash your Node.js application process with a single UDP packet. They only need network access to the exposed webRTCDirect listener port.
Root cause
The STUN listener passes an unvalidated, packet-controlled ufrag into DirectRTCPeerConnection.setLocalDescription as an ICE password, triggering an uncaught native invalid_argument exception and SIGABRT in node-datachannel.
Affected systems
@libp2p/webrtc prior to 6.0.28
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade @libp2p/webrtc to version 6.0.28 or later. If updating immediately is not possible, disable the webRTCDirect transport or block incoming UDP traffic to its listening ports.
$ npm install @libp2p/webrtc@^6.0.28AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.