libp2p js-libp2p vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20268

Newest CVEs

• CVE-2026-103936

  libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

  libp2p · js-libp2p

  High7.5
• CVE-2026-86040

  libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS

  libp2p · js-libp2p

  High7.5
• CVE-2026-86039

  libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

  libp2p · js-libp2p

  High8.2
• CVE-2026-86038

  libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

  libp2p · js-libp2p

  High7.5
• CVE-2026-77384

  libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

  libp2p · js-libp2p

  High7.5
• CVE-2026-49866

  libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

  libp2p · js-libp2p

  High7.5
• CVE-2026-45783

  libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

  libp2p · js-libp2p

  High7.5
• CVE-2026-46679

  libp2p: Memory DoS via subscription flood of unique topics

  libp2p · js-libp2p

  High7.5
• CVE-2022-23487

  libp2p denial of service vulnerability from lack of resource management

  libp2p · js-libp2p

  High7.5