Security: bundled libSRT v1.5.5 is vulnerable to CVE-2026-55869 and CVE-2026-55868 (fixed upstream in v1.5.6)

Open Beginner friendly
#89 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
build-system, security

Research direction

Start in scripts/build-srt-sdk.js and inspect the SRT_CHECKOUT pin, then run npm run build-srt && npm run rebuild. Update the pinned libSRT version to the fixed release and verify npm test && npm run test-jest pass; a maintainer must review the Tier B change and handle the patch release.

Written by the indexing model from the issue text.

Description

build-issue ready-for-maintainer

Summary

Upstream libSRT (Haivision/srt) published two Critical (CVSS 9.1) security advisories on 2026-07-20, fixed in v1.5.6:

CVE Advisory Description
CVE-2026-55869 GHSA-6xg9-784j-24rm Heap-based buffer overflow in KMREQ handling — received message size wasn't validated against the destination buffer during copy.
CVE-2026-55868 GHSA-4mc6-qmpp-g7gw Encryption state machine downgrade.

The v1.5.6 release notes list additional related hardening (KMRSP wire-length validation, LOSSREPORT/DROPREQ out-of-bounds read fixes, CRcvBuffer::dropMessage bounds guard).

Impact on node-srt

scripts/build-srt-sdk.js currently pins:

const SRT_CHECKOUT = "v1.5.5";

This means every install of @eyevinn/srt builds and links a libSRT version affected by both CVEs above — one version behind the fix.

Requested action

Bump SRT_CHECKOUT to v1.5.6 (or later) in scripts/build-srt-sdk.js, verify npm run build-srt && npm run rebuild && npm test && npm run test-jest still pass, and cut a patch release of @eyevinn/srt.

This touches the native build/libSRT pin, so per the project's merge policy this is Tier B — needs a human maintainer decision, not auto-merge, even once a fix PR is opened.

Filed by the node-srt maintenance bot after independently verifying the CVEs against the Debian security tracker and Haivision/srt's own GitHub Security Advisories (not solely on the basis of an external email alerting to them).

Dominant language
JavaScript
Stars
99
Forks
35
Avg merge
2d 10h
Merged PRs (30d)
3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Eyevinn/node-srt

All issues in Eyevinn/node-srt

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.