libp2p WebRTC CVE-2026-103936

The target must be running @libp2p/webrtc (js-libp2p) before version 6.0.28 with a webRTCDirect() listener on Node.js (not a browser peer), backed by node-datachannel/libdatachannel. Because the STUN Binding Request is processed before PeerId authentication, Noise, muxing, protocol negotiation, and connection-manager admission, NO credentials, prior connection, or user interaction are required - a single UDP packet reaching the listener suffices. The only prerequisite content is a ufrag that violates the RFC 8445 ICE-credential requirement (22-256 chars from [a-zA-Z0-9+/]); any shorter or out-of-charset value triggers the crash. Limiting factors that reduce real-world exposure: browser-side peers are unaffected, nodes that do not expose a webRTCDirect UDP listener are unaffected, and the impact is confined to termination of the single listening process.

All signals point to a genuine but narrowly-scoped availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is credible and internally consistent with the description: a single unauthenticated remote UDP packet processed before any PeerId/Noise authentication triggers an uncaught native exception (CWE-248) and SIGABRT, killing the process. The high CVSS is driven entirely by the availability impact (A:H); there is explicitly NO confidentiality, integrity, code-execution, or memory-corruption impact, so despite the 'HIGH' label this is a pure denial-of-service, not a critical compromise. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from intelligence feeds - there is no public exploit identified at time of analysis, though the vendor patch ships a regression test that reproduces the crash, making the trigger condition trivially understood. Note a tagging conflict: the input Tags assert 'RCE' and 'Buffer Overflow', which directly contradict the authoritative advisory text stating no code execution or memory corruption - these tags are wrong and should not inflate perceived severity. Real-world priority is moderate: easy, reliable, unauthenticated remote DoS against any exposed webRTCDirect Node.js listener, but with no path to data loss or RCE and a narrow affected deployment surface.

An attacker who can reach the UDP port of a Node.js peer running a @libp2p/webrtc webRTCDirect() listener sends a single crafted STUN Binding Request whose ufrag is shorter than the RFC 8445 minimum (or uses an invalid character set). The listener forwards the attacker-controlled ufrag into setLocalDescription as the ICE password without validation, node-datachannel/libdatachannel raises an uncaught native invalid_argument, and the entire process aborts with SIGABRT. No authentication is required and no public exploit tool is needed - the vendor's own regression test demonstrates the crash with a short 'controlled' value.