CVE-2026-103936 Details
Description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.
A denial-of-service vulnerability has been identified in the libp2p JavaScript implementation, specifically in the @libp2p/webrtc package, prior to version 6.0.28. The issue arises in the webRTCDirect() Node.js listener, which processes unauthenticated STUN Binding Requests before completing PeerId authentication or establishing connections. This flaw allows a remote attacker to send a single UDP packet that triggers an uncaught native error, causing the Node.js process to abort. The vulnerability has been confirmed to terminate the process without causing memory corruption, unauthorized code execution, or impacting browser functionality.
Users can upgrade to libp2p webrtc version 6.0.28 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libp2p/js-libp2p/commit/68794c8e2e67d5f38da59e379dc051b2789e46f6 | [email protected] | Source CodeVendor |
| https://github.com/libp2p/js-libp2p/pull/3584 | [email protected] | Source CodeVendor |
| https://github.com/libp2p/js-libp2p/releases/tag/webrtc-v6.0.28 | [email protected] | Release NotesVendor |
| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x3m2-6mg8-vj7f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libp2p | All versions |
CPE
Remediation
| |
| libp2p/js-libp2p | All versions |
CPE
Remediation
| |
| libp2p/@libp2p/webrtc | < 6.0.28 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |