Skip to content
OpenAdvisories

Package · npm

@libp2p/gossipsub

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-86038

    libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

    libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attac…

    libp2p js-libp2p @libp2p/gossipsub npm
  • High 7.5
    CVE-2026-49866

    libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

    libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeR…

    libp2p js-libp2p @libp2p/gossipsub npm
  • High 7.5
    CVE-2026-46679

    libp2p: Memory DoS via subscription flood of unique topics

    libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issu…

    libp2p js-libp2p @libp2p/gossipsub npm