libp2p vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20232
3. 20241
4. 20251
5. 202618

Newest CVEs

• CVE-2026-95859

  libp2p-rust: Gossipsub GRAFT topics unbounded growth

  libp2p · rust-libp2p

  High8.7
• CVE-2026-103936

  libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

  libp2p · js-libp2p

  High7.5
• CVE-2026-86040

  libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS

  libp2p · js-libp2p

  High7.5
• CVE-2026-86039

  libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

  libp2p · js-libp2p

  High8.2
• CVE-2026-86038

  libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

  libp2p · js-libp2p

  High7.5
• CVE-2026-61544

  libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

  libp2p · rust-libp2p

  High8.2
• CVE-2026-89146

  libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses

  libp2p · libp2p-rendezvous

  High8.7
• CVE-2026-77384

  libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

  libp2p · js-libp2p

  High7.5
• CVE-2026-73568

  py-libp2p: yamux connection DoS via oversized data frame

  libp2p · py-libp2p

  High7.5
• CVE-2026-49866

  libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

  libp2p · js-libp2p

  High7.5