{"action":"Upgrade mediasoup to 0.22.5 or later.","affected":[{"fixed":"0.22.5","introduced":"0.22.0"}],"component":"mediasoup","cve_ids":["CVE-2026-55663"],"ecosystem":"crates.io","epss":0.00188,"exploited":false,"fixed_versions":["0.22.5"],"ghsa_id":"GHSA-p7x2-g5cq-fhmq","id":"tcs_01M5KF20KMMAJC6A1CJ7V5EBZQ","modified_at":"2026-08-26T01:18:34.692749539Z","published_at":"2026-08-25T18:17:21Z","references":["https://osv.dev/vulnerability/GHSA-p7x2-g5cq-fhmq","https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq","https://github.com/versatica/mediasoup/pull/1829","https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","https://github.com/versatica/mediasoup","https://github.com/versatica/mediasoup/releases/tag/3.20.6"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-p7x2-g5cq-fhmq#crates.io/mediasoup","url":"https://osv.dev/vulnerability/GHSA-p7x2-g5cq-fhmq"}],"summary":"mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)"}