CVE-2026-55663 versatica CVE debrief

Who should care

Defenders responsible for WebRTC video conferencing systems using mediasoup should assess their exposure and prioritize verifying and updating mediasoup to the latest version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their systems are updated and secured against potential exploitation.

Why it matters

The mediasoup vulnerability allows an on-path attacker to forge a COOKIE-ECHO packet and establish an unauthorized SCTP association, permitting DataChannel message injection as a trusted peer. Defenders should prioritize verifying and updating mediasoup to version 3.20.6 or later for npm and version 0.22.5 or later for the Rust crate.

• An on-path attacker can establish an unauthorized SCTP association and inject DataChannel messages as a trusted peer.
• The vulnerability allows for potential data tampering or injection in WebRTC video conferencing systems using mediasoup.
• Defenders need to verify and update mediasoup to prevent potential exploitation.
• The hardcoded magic values used for authenticating state cookies do not provide adequate security.

Technical summary

The mediasoup vulnerability allows an on-path attacker to forge a COOKIE-ECHO packet and establish an unauthorized SCTP association, permitting DataChannel message injection as a trusted peer. This is due to the use of hardcoded magic values instead of a per-instance secret and HMAC for authenticating state cookies, contrary to RFC 9260 Section 5.1.3. The vulnerability affects versions 3.20.0 through 3.20.6 of the npm package and versions 0.22.0 through 0.22.5 of the Rust crate. Defenders should prioritize verifying and updating mediasoup to version 3.20.6 or later for npm and version 0.22.5 or later for the Rust crate.

Defensive priority

Defenders should prioritize verifying and updating mediasoup to version 3.20.6 or later for npm and version 0.22.5 or later for the Rust crate. They should also assess their exposure and implement compensating controls, such as monitoring for suspicious DataChannel activity.

Recommended defensive actions

• Verify and update mediasoup to version 3.20.6 or later for npm and version 0.22.5 or later for the Rust crate.
• Assess exposure and implement compensating controls, such as monitoring for suspicious DataChannel activity.
• Review and update inventory to ensure only authorized SCTP associations are established.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the affected versions. The source references include commits, pull requests, and release notes from the mediasoup repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.