CVE-2026-55663

Name of the Vulnerable Software and Affected Versions mediasoup npm package versions 3.20.0 through 3.20.5 mediasoup Rust crate versions 0.22.0 through 0.22.4

Description The built-in SCTP stack authenticates state cookies using hardcoded magic values instead of a per-instance secret and HMAC, which deviates from RFC 9260 Section 5.1.3. This flaw in StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk() allows an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO. By matching the packet verification tag with a localVerificationTag controlled by the attacker, an unauthorized SCTP association can be established, enabling DataChannel message injection as a trusted peer. SCTP is a transport layer protocol used to ensure reliable delivery of data.

Recommendations Update the npm package to version 3.20.6. Update the Rust crate to version 0.22.5.