From 7229f470035dd66ad0261e33d7fdcaec37dc1af1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20Birm=C3=A9?= Date: Thu, 13 Aug 2026 16:12:59 +0200 Subject: [PATCH] Bump bundled libSRT to v1.5.6 (security fix) Upstream libSRT v1.5.6 fixes two critical (CVSS 9.1) vulnerabilities: - CVE-2026-55869: heap-based buffer overflow in KMREQ handling (GHSA-6xg9-784j-24rm) - CVE-2026-55868: encryption state machine downgrade (GHSA-4mc6-qmpp-g7gw) node-srt pinned SRT_CHECKOUT at v1.5.5, one version behind the fix, so every install built and linked a vulnerable libSRT. Verified locally on macOS (arm64): - npm run build-srt: clones and builds libSRT v1.5.6 successfully (deps/build/lib/libsrt.1.5.6.dylib, version.h confirms 1.5.6) - npm run rebuild: node-gyp rebuild links the addon against the new library with no errors - npm test: 22 jasmine specs, 0 failures - npm run check-tsc: no type errors Fixes #89 Co-Authored-By: Claude Sonnet 5 --- scripts/build-srt-sdk.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/build-srt-sdk.js b/scripts/build-srt-sdk.js index 3a77de5..c9310ec 100755 --- a/scripts/build-srt-sdk.js +++ b/scripts/build-srt-sdk.js @@ -13,7 +13,7 @@ const os = require('os'); const env = process.env; const SRT_REPO = env.NODE_SRT_REPO || "https://github.com/Haivision/srt.git"; -const SRT_CHECKOUT = "v1.5.5"; +const SRT_CHECKOUT = "v1.5.6"; const srtRepoPath = env.NODE_SRT_LOCAL_REPO ? `file://${path.join(__dirname, env.NODE_SRT_LOCAL_REPO)}` : SRT_REPO; const srtCheckout = env.NODE_SRT_CHECKOUT || SRT_CHECKOUT;