Security: bundled libSRT v1.5.5 is vulnerable to CVE-2026-55869 and CVE-2026-55868 (fixed upstream in v1.5.6)

[birme]

Summary

Upstream libSRT (Haivision/srt) published two Critical (CVSS 9.1) security advisories on 2026-07-20, fixed in v1.5.6:

CVE	Advisory	Description
CVE-2026-55869	GHSA-6xg9-784j-24rm	Heap-based buffer overflow in KMREQ handling — received message size wasn't validated against the destination buffer during copy.
CVE-2026-55868	GHSA-4mc6-qmpp-g7gw	Encryption state machine downgrade.

The v1.5.6 release notes list additional related hardening (KMRSP wire-length validation, LOSSREPORT/DROPREQ out-of-bounds read fixes, CRcvBuffer::dropMessage bounds guard).

Impact on node-srt

scripts/build-srt-sdk.js currently pins:

const SRT_CHECKOUT = "v1.5.5";

This means every install of @eyevinn/srt builds and links a libSRT version affected by both CVEs above — one version behind the fix.

Requested action

Bump SRT_CHECKOUT to v1.5.6 (or later) in scripts/build-srt-sdk.js, verify npm run build-srt && npm run rebuild && npm test && npm run test-jest still pass, and cut a patch release of @eyevinn/srt.

This touches the native build/libSRT pin, so per the project's merge policy this is Tier B — needs a human maintainer decision, not auto-merge, even once a fix PR is opened.

---

Filed by the node-srt maintenance bot after independently verifying the CVEs against the Debian security tracker and Haivision/srt's own GitHub Security Advisories (not solely on the basis of an external email alerting to them).

[birme]

Opened #90 to fix this — bumps SRT_CHECKOUT to v1.5.6 in scripts/build-srt-sdk.js. Verified locally: builds v1.5.6 cleanly, addon links, jasmine suite (22/22) and typecheck pass; test-jest shows the same pre-existing 2 failures on this branch as on unmodified master (unrelated Node-version incompatibility in the integration test file, not a regression from this bump). Labelled ready-for-maintainer per the native-build Tier B policy — needs a human to merge.

— node-srt maintenance bot

[birme]

Update: the straightforward fix (bump SRT_CHECKOUT to v1.5.6, see #90) is blocked. It does fix both CVEs, but it also pulls in an unrelated upstream regression — Haivision/srt#3327 (commit 1e4c908c) introduces a shutdown-race segfault (destroys receive-queue internals while a worker thread is still running inside them), bisected and reproduced with a gdb backtrace. It's not caused by either CVE fix and reproduces outside CI too, so it's a real risk for production use on Linux, not just a test flake. Full root-cause writeup is on #90.

This now needs a maintainer decision: wait for an upstream point release that excludes that commit, or cherry-pick just the security fixes onto v1.5.5. Leaving both open.

[birme]

Re-verified: explicitly closing every socket in the test suite does not avoid the v1.5.6 crash (tested directly). The regression is inside libSRT's own global-destructor/GC-thread-join sequencing at process exit, not something node-srt's socket handling can influence. Root-cause conclusion from the previous comment stands: this needs an upstream fix or a targeted cherry-pick, not a node-srt-side change. Full evidence on #90.

[birme]

Filed upstream: Haivision/srt#3354. Tracking there for a fix/response before deciding between waiting or cherry-picking the CVE commits onto v1.5.5.

[birme]

Update: proposed upstream patch fixes the crash but introduces a worse hang-on-exit bug. Details: Haivision/srt#3354 (comment). Still blocked.