Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103936— libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

Quick assessment

Affected
libp2p js-libp2p
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libp2p 是 libp2p 网络协议栈的 JavaScript 实现。在 6.0.28 版本之前，@libp2p/webrtc 的 webRTCDirect() Node.js 监听器在处理未认证的 STUN Binding 请求时，在 PeerId 认证、Noise 加密、多路复用（muxing）、协议协商、连接创建或连接管理器（connection-manager）准入判断之前，就对这些请求进行了处理。 具体而言， 中的监听器会将包含数据包控制信息的请求 转发给 ，其中该值被直接用作 ICE 密码，而未对其

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
@libp2p webrtc < 6.0.28 affected
libp2p js-libp2p < 3.3.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103936

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
Source: CVE Program / CVE List V5
Vulnerability Description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libp2p js-libp2p < 3.3.7 -
@libp2p webrtc < 6.0.28 -

II. Public POCs for CVE-2026-103936

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103936

请登录查看更多情报信息。

Other References for CVE-2026-103936 (4)

IV. Related Vulnerabilities

Same product: js-libp2p
Same vendor: libp2p
Same weakness: CWE-248

V. Comments for CVE-2026-103936

No comments yet

Leave a comment