{"action":"Upgrade mediasoup to 3.20.6 or later.","affected":[{"fixed":"3.20.6","introduced":"3.20.0"}],"component":"mediasoup","cve_ids":["CVE-2026-55663"],"ecosystem":"npm","epss":0.00188,"exploited":false,"fixed_versions":["3.20.6"],"ghsa_id":"GHSA-p7x2-g5cq-fhmq","id":"tcs_01M5KF20EFK2N8J41E6AWE3HSP","modified_at":"2026-08-26T01:18:34.692749539Z","published_at":"2026-08-25T18:17:21Z","references":["https://osv.dev/vulnerability/GHSA-p7x2-g5cq-fhmq","https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq","https://github.com/versatica/mediasoup/pull/1829","https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","https://github.com/versatica/mediasoup","https://github.com/versatica/mediasoup/releases/tag/3.20.6"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-p7x2-g5cq-fhmq","url":"https://osv.dev/vulnerability/GHSA-p7x2-g5cq-fhmq"}],"summary":"mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)"}