AIKIDO-2026-876449
@libp2p/webrtc is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
@libp2p/webrtcTL;DR
The WebRTC-direct listener processes unauthenticated STUN/ICE Binding Request packets and extracts an ICE user fragment before any connection validation. The packet-derived ufrag is reused as an ICE password when initializing the native WebRTC peer connection, and a ufrag that is too short makes the native node-datachannel library throw an uncaught exception. A single crafted STUN packet sent to the UDP listen port aborts the Node.js process, denying service to all libp2p functionality before any connection is created or authenticated. The fix validates the ufrag from incoming STUN requests before it is used to configure the peer connection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a WebRTC-direct listener on Node.js.
Background info
@libp2p/webrtc is vulnerable to Denial of Service (DoS) in versions 5.1.0 - 6.0.27.
How to fix this
Upgrade the @libp2p/webrtc library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant