Repository navigation
Security: bundled libSRT v1.5.5 is vulnerable to CVE-2026-55869 and CVE-2026-55868 (fixed upstream in v1.5.6) #89
Description
Summary
Upstream libSRT (Haivision/srt) published two Critical (CVSS 9.1) security advisories on 2026-07-20, fixed in v1.5.6:
| CVE | Advisory | Description |
|---|---|---|
| CVE-2026-55869 | GHSA-6xg9-784j-24rm | Heap-based buffer overflow in KMREQ handling — received message size wasn't validated against the destination buffer during copy. |
| CVE-2026-55868 | GHSA-4mc6-qmpp-g7gw | Encryption state machine downgrade. |
The v1.5.6 release notes list additional related hardening (KMRSP wire-length validation, LOSSREPORT/DROPREQ out-of-bounds read fixes, CRcvBuffer::dropMessage bounds guard).
Impact on node-srt
scripts/build-srt-sdk.js currently pins:
const SRT_CHECKOUT = "v1.5.5";This means every install of @eyevinn/srt builds and links a libSRT version affected by both CVEs above — one version behind the fix.
Requested action
Bump SRT_CHECKOUT to v1.5.6 (or later) in scripts/build-srt-sdk.js, verify npm run build-srt && npm run rebuild && npm test && npm run test-jest still pass, and cut a patch release of @eyevinn/srt.
This touches the native build/libSRT pin, so per the project's merge policy this is Tier B — needs a human maintainer decision, not auto-merge, even once a fix PR is opened.
Filed by the node-srt maintenance bot after independently verifying the CVEs against the Debian security tracker and Haivision/srt's own GitHub Security Advisories (not solely on the basis of an external email alerting to them).
Activity
birme commentedon Aug 13, 2026
Opened #90 to fix this — bumps
SRT_CHECKOUTtov1.5.6inscripts/build-srt-sdk.js. Verified locally: builds v1.5.6 cleanly, addon links, jasmine suite (22/22) and typecheck pass;test-jestshows the same pre-existing 2 failures on this branch as on unmodifiedmaster(unrelated Node-version incompatibility in the integration test file, not a regression from this bump). Labelledready-for-maintainerper the native-build Tier B policy — needs a human to merge.— node-srt maintenance bot
birme commentedon Aug 13, 2026
Update: the straightforward fix (bump
SRT_CHECKOUTto v1.5.6, see #90) is blocked. It does fix both CVEs, but it also pulls in an unrelated upstream regression — Haivision/srt#3327 (commit1e4c908c) introduces a shutdown-race segfault (destroys receive-queue internals while a worker thread is still running inside them), bisected and reproduced with a gdb backtrace. It's not caused by either CVE fix and reproduces outside CI too, so it's a real risk for production use on Linux, not just a test flake. Full root-cause writeup is on #90.This now needs a maintainer decision: wait for an upstream point release that excludes that commit, or cherry-pick just the security fixes onto v1.5.5. Leaving both open.
birme commentedon Aug 13, 2026
Re-verified: explicitly closing every socket in the test suite does not avoid the v1.5.6 crash (tested directly). The regression is inside libSRT's own global-destructor/GC-thread-join sequencing at process exit, not something node-srt's socket handling can influence. Root-cause conclusion from the previous comment stands: this needs an upstream fix or a targeted cherry-pick, not a node-srt-side change. Full evidence on #90.
birme commentedon Aug 14, 2026
Filed upstream: Haivision/srt#3354. Tracking there for a fix/response before deciding between waiting or cherry-picking the CVE commits onto v1.5.5.
birme commentedon Aug 14, 2026
Update: proposed upstream patch fixes the crash but introduces a worse hang-on-exit bug. Details: Haivision/srt#3354 (comment). Still blocked.