QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQU…

CVE-2026-54609 affects QTI Neon version 1.0.0, a minimal relay-based UDP multiplayer protocol library. The vulnerability exists in the relay's handleReconnectRequest function, which forwards RECONNECT_REQUEST packets to the host without any rate limiting or bounding. An unauthenticated client can exploit this to drive relay-to-host packet amplification, resulting in a denial of service against the host. The flaw requires no authentication to exploit, lowering the barrier for attack. The issue stems from a lack of input validation and request throttling in the relay logic. As of the time of review, no fixed version of QTI Neon is available. Users of this library are advised to implement external mitigations such as rate limiting at the network level until a patch is released.