TI-2026-74854 Aliases CVE-2026-103936

Unauthenticated STUN packet crashes libp2p WebRTC-direct listeners

LOW 39CWE-248Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

The @libp2p/webrtc package before 6.0.28 and js-libp2p before 3.3.7 are affected. The webRTCDirect() Node.js listener passes a short ICE password taken from an unauthenticated STUN Binding Request to node-datachannel or libdatachannel, which raises an uncaught native exception (CWE-248). A single remote UDP packet sent before any authentication aborts the process with SIGABRT, which denies service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00522 44th percentileScored 2026-11-07

Fix Fixed js-libp2p (libp2p): 3.3.7webrtc (@libp2p): 6.0.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
libp2p	js-libp2p	before 3.3.7	3.3.7	Patch available	CNA
libp2p	webrtc	before 6.0.28	6.0.28	Patch available	CNA

js-libp2p Vendorlibp2p Affected before 3.3.7 Fixed in 3.3.7 Patch available CNA
webrtc Vendorlibp2p Affected before 6.0.28 Fixed in 6.0.28 Patch available CNA

Remediation

Upgrade @libp2p/webrtc to version 6.0.28, which fixes the issue. The sources list no fixed version for js-libp2p.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA js-libp2p (libp2p) Fixed in 3.3.7
Fix · CNA webrtc (@libp2p) Fixed in 6.0.28

Timeline

2026-10-16 Threatist record created from CVE-2026-103936
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 CISA SSVC decision points changed

References

Other 4

TI-2026-60386 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses CVSS 4.0HIGH 8.7
TI-2026-58865 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses CVSS 3.1HIGH 8.2
TI-2026-44102 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake CVSS 4.0HIGH 8.2
TI-2026-27587 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion CVSS 3.1HIGH 8.2
TI-2026-58864 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID CVSS 3.1HIGH 7.5
TI-2026-53982 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion CVSS 3.1HIGH 7.5

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences