Read the docs
TI-2016-08561 Aliases CVE-2016-10519GHSA-77g4-36jp-5v3m

Information disclosure in HackerOne bittorrent-dht node module

Priority LOW 36CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-201.

Summary

A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.

Why it matters now

EPSS 0.01612 76th percentileScored 2026-11-07
Fix Fixed bittorrent-dht node module (HackerOne): 5.1.3bittorrent-dht (npm): 5.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOnebittorrent-dht node modulebefore 5.1.35.1.3Patch availableCNA
—bittorrent-dht (npm)before 5.1.35.1.3Patch availableGHSA-77g4-36jp-5v3m
  • bittorrent-dht node module VendorHackerOne Affected before 5.1.3 Fixed in 5.1.3 Patch available CNA
  • bittorrent-dht (npm) Vendor— Affected before 5.1.3 Fixed in 5.1.3 Patch available GHSA-77g4-36jp-5v3m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:webtorrent:bittorrent-dht:*:*:*:*:*:node.js:*:*before 5.1.3VulnerableWebtorrent
  • cpe:2.3:a:webtorrent:bittorrent-dht:*:*:*:*:*:node.js:*:* Versions before 5.1.3 Vulnerable ·Webtorrent

Remediation

  • Fix · CNA bittorrent-dht node module (HackerOne) Fixed in 5.1.3
  • Fix · GHSA-77g4-36jp-5v3m bittorrent-dht (npm) Fixed in 5.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-10519
  2. 2026-10-03 Alias added: GHSA-77g4-36jp-5v3m

References

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences