js-libp2p vulnerabilities

9 known vulnerabilities in js-libp2p from Libp2p. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  js-libp2p: Uncaught Exception

  CVE-2026-103936Oct 15, 2026Libp2p

  libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connect

• 7.5 High severity

  js-libp2p: Uncontrolled Resource Consumption

  CVE-2026-86040Sep 17, 2026Libp2p

  libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf ele

• 8.2 High severity

  js-libp2p: Authentication Bypass by Spoofing

  CVE-2026-86039Sep 17, 2026Libp2p

  libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the sig

• 7.5 High severity

  js-libp2p: Insufficient Verification of Data Authenticity

  CVE-2026-86038Sep 17, 2026Libp2p

  libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attack

• 7.5 High severity

  js-libp2p: Uncontrolled Resource Consumption

  CVE-2026-77384Aug 24, 2026Libp2p

  libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a resu

• 7.5 High severity

  js-libp2p: Allocation of Resources Without Limits or Throttling

  CVE-2026-49866Jul 8, 2026Libp2p

  libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRp

• 7.5 High severity

  libp2p is a JavaScript Implementation of libp2p networking stack.

  CVE-2026-46679Jun 10, 2026Libp2p

  libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue

• 7.5 High severity

  libp2p is a JavaScript Implementation of libp2p networking stack.

  CVE-2026-45783Jun 10, 2026Libp2p

  libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose

• 7.5 High severity

  js-libp2p: Allocation of Resources Without Limits or Throttling

  CVE-2022-23487Dec 7, 2022Libp2p

  js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An