{"schema":"threatline.record/2","record":{"id":"CVE-2026-103936","aliases":["GHSA-x3m2-6mg8-vj7f"],"summary":"libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners","details":"libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.","categories":["Unclassified"],"product":"js-libp2p","vendor":"libp2p","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103936","source_modified_at":"2026-10-16T17:12:49.532Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"js-libp2p","vendor":"libp2p","versions":[{"version":"< 3.3.7","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103936","source_modified_at":"2026-10-16T17:12:49.532Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"webrtc","vendor":"@libp2p","versions":[{"version":"< 6.0.28","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00522,"percentile":0.43464,"score_date":"2026-10-23"},"published_at":"2026-10-15T17:28:32.567Z","modified_at":"2026-10-16T17:12:49.532Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103936","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T17:12:49.532Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103936","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x3m2-6mg8-vj7f","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/libp2p/js-libp2p/pull/3584","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/libp2p/js-libp2p/commit/68794c8e2e67d5f38da59e379dc051b2789e46f6","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/libp2p/js-libp2p/releases/tag/webrtc-v6.0.28","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T15:22:18.274644Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T17:12:49.532Z","content_hash":"5da093e8f844f071af338bbfde6f4cbfe10ecc21399e5e765c6fa0a6d5d1a42c"}}