CVE-2026-103936
Received Received - Intake

WebRTC Listener DoS via Malformed STUN Credentials in libp2p

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-103936
EUVD
EUVD-2026-102224

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libp2p js-libp2p < 3.3.7
@libp2p webrtc < 6.0.28

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the libp2p WebRTC transport in JavaScript. It allows an unauthenticated attacker to send a single STUN packet to a public UDP port, causing the Node.js listener to crash before any authentication or connection setup. The issue occurs because the ufrag (ICE username fragment) from the STUN request is reused as an ICE password without proper validation. If the ufrag is too short or contains invalid characters, it triggers a native crash (SIGABRT) in the underlying WebRTC backend.

Detection Guidance

To detect this vulnerability, monitor for unexpected process terminations of libp2p WebRTC listeners. Check logs for SIGABRT errors in Node.js applications using @libp2p/webrtc versions prior to 6.0.28. Use network monitoring tools to inspect incoming STUN packets on UDP ports used by WebRTC.

Impact Analysis

The primary impact is denial of service. An attacker can terminate the Node.js process hosting the libp2p WebRTC listener with a single UDP packet. This disrupts all active WebRTC connections and prevents new connections from being established. There is no evidence of memory corruption, code execution, or data theft.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) by terminating Node.js processes handling WebRTC connections. It does not lead to data breaches, confidentiality loss, or integrity compromise, which are key concerns for GDPR and HIPAA. However, repeated DoS attacks could disrupt services, potentially impacting availability requirements under these regulations.

Mitigation Strategies

Upgrade @libp2p/webrtc to version 6.0.28 or later. If upgrading is not immediately possible, restrict UDP traffic to known STUN servers or block unauthenticated STUN Binding Requests at the network perimeter. Ensure Node.js applications using libp2p are restarted after applying updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103936. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart