npm/mediasoup CVE-2026-55663: medium 5.6, EPSS 0.19%
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
Action: Upgrade mediasoup to 3.20.6 or later.
npm i mediasoup@3.20.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.20.0 | 3.20.6 | - |
Fixed versions
| 3.20.6 |
Sources
- osv: GHSA-p7x2-g5cq-fhmq
- https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq
- https://github.com/versatica/mediasoup/pull/1829
- https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7
- https://github.com/versatica/mediasoup
- https://github.com/versatica/mediasoup/releases/tag/3.20.6
CVE-2026-55663 · published · modified · JSON