Is CVE-2026-103936 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103936 being exploited in the wild.

How severe is CVE-2026-103936?

High severity, with a CVSS score of 7.5, published 15 October 2026.

Which products and versions are affected?

Libp2p @Libp2p/Webrtc prior to 6.0.28.

How is CVE-2026-103936 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103936?

Check whether you run Libp2p @Libp2p/Webrtc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103936: libp2p WebRTC denial of service in STUN handling

CVE-2026-103936 · Severity: high · CVSS 7.5 · Published 2026-10-15

libp2p is a JavaScript peer-to-peer networking library used in distributed applications. The WebRTC transport component processes incoming network packets without validating ICE credentials before passing them to native code, allowing an attacker to send a single malformed UDP packet that crashes the entire Node.js process and causes service outage.

Vendors: Libp2p.

Quick answers

Is CVE-2026-103936 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103936 being exploited in the wild.
How severe is CVE-2026-103936?: High severity, with a CVSS score of 7.5, published 15 October 2026.
Which products and versions are affected?: Libp2p @Libp2p/Webrtc prior to 6.0.28.
Is there a fix for CVE-2026-103936?: Yes: fixed in 6.0.28. Until then: Validate incoming STUN requests to ensure the ICE ufrag conforms to RFC 8445 requirements (22–256 characters from [A-Za-z0-9+/]) before passing to native connection setup, and reject invalid credentials at the listener and before setLocalDescription.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-15"}, {"kind": "patched", "at": "2026-07-26"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103936 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103936?: Check whether you run Libp2p @Libp2p/Webrtc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.0.28

Validate incoming STUN requests to ensure the ICE ufrag conforms to RFC 8445 requirements (22–256 characters from [A-Za-z0-9+/]) before passing to native connection setup, and reject invalid credentials at the listener and before setLocalDescription.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-15"}, {"kind": "patched", "at": "2026-07-26"}]

Technical details

The @libp2p/webrtc transport accepts STUN Binding Requests before authentication or PeerId validation, extracting an unvalidated ICE ufrag value and passing it directly to setLocalDescription via DirectRTCPeerConnection. This value must conform to RFC 8445 (22–256 characters from [A-Za-z0-9+/]), but the code does not validate length or character set, causing node-datachannel to raise an uncaught native invalid_argument exception and abort the process with SIGABRT. An unauthenticated remote attacker on the network can exploit this with a single crafted UDP packet.

Affected products

libp2p @libp2p/webrtc prior to 6.0.28

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.