The vulnerability allows an unauthenticated UDP STUN Binding Request to be processed before authentication in the @libp2p/webrtc listener. When the request contains a short credential, the packet‑controlled ufrag value is forwarded as an ICE password, which violates expected formatting rules. This triggers a native invalid_argument error that aborts the node process with SIGABRT, terminating the WebRTC‑direct listener. The confirmed impact is a denial of service of the individual Node.js process; no memory corruption, code execution, or data leakage is demonstrated.

Affected products are @libp2p:webrtc and libp2p:js-libp2p. Any installation of these libraries earlier than version 6.0.28 is vulnerable. Versions 6.0.28 and later contain the fix; therefore all upstream Node.js applications that depend on these modules and expose WebRTC‑direct listeners are at risk until updated.

Based on the description, the attacker can craft a single STUN packet from any remote host to trigger the denial of service. The CVSS score of 7.5 indicates a high severity and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV database, implying no known active exploit campaigns. The attack route is a remote network vector; no privileged access or local execution is required.