libp2p webrtc vulnerabilities

Latest libp2p webrtc CVEs

Newest publication first

1. CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

   Published 2026-10-15

   High·CVSS 7.5 EPSS 0.52%

   libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or con...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.