[@openclaw/voice-call] OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure

**[@openclaw/voice-call] OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure**

Summary @openclaw/voice-call (and the bundled copy shipped in openclaw) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure. Affected Packages / Versions openclaw (npm): vulnerable <= 2026.2.21-2, patched in 2026.2.22. @openclaw/voice-call (npm): vulnerable <= 2026.2.21, patched in 2026.2.22. Technical Details Before this fix, the voice-call media-stream path upgraded sockets first and ran shouldAcceptStream() after a later start frame...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.