Skip to content
Libp2p Js-libp2p vulnerabilities
-
@libp2p webrtc, libp2p js-libp2p +1 more
libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
CVE-2026-103936
7.5 High
-
@libp2p floodsub, libp2p js-libp2p +1 more
libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
CVE-2026-86040
7.5 High
-
libp2p js-libp2p
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
CVE-2026-86039
Fix available
8.2 High
-
libp2p js-libp2p
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
CVE-2026-86038
Fix available
7.5 High
-
libp2p js-libp2p
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
CVE-2026-77384
7.5 High
-
libp2p js-libp2p
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-49866
Fix available
7.5 High
-
libp2p js-libp2p
libp2p: Memory DoS via subscription flood of unique topics
CVE-2026-46679
Fix available
7.5 High
-
libp2p js-libp2p
libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
CVE-2026-45783
Fix available
7.5 High
-
libp2p js-libp2p, protocol libp2p +1 more
libp2p denial of service vulnerability from lack of resource management
CVE-2022-23487
Fix available
7.5 High