Repository navigation
Security: libp2p/js-libp2p
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
floodsub StrictSign verifies the signature against the untrusted message.key with no binding to message.from, allowing peer impersonationGHSA-pxv8-j7h7-m2pj published
Oct 16, 2026 by tabcatHigh -
gossipsub creates a permanent topics-map entry per distinct subscription with no cap in the default configGHSA-x2vm-cf3p-m2w8 published
Aug 18, 2026 by tabcatHigh -
ASN.1 DER decoder drives an unbounded synchronous loop on attacker-controlled length fields, stalling the Node event loop pre-authGHSA-rvfr-cqwq-rc4j published
Aug 18, 2026 by tabcatHigh -
Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listenersGHSA-x3m2-6mg8-vj7f published
Aug 18, 2026 by tabcatHigh -
Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSGHSA-cvfg-hcf3-ggwv published
Aug 18, 2026 by tabcatHigh -
Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustionGHSA-x787-gh7p-hmq7 published
Aug 18, 2026 by tabcatModerate -
Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer IDGHSA-c3gv-825q-fvmp published
Aug 14, 2026 by tabcatHigh -
PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addressesGHSA-vrf4-mx87-p53w published
Aug 18, 2026 by tabcatHigh -
CPU DoS via oversized IHAVE and IWANT control message arraysGHSA-cwc9-cp4j-mcvv published
Jun 14, 2026 by tabcatHigh -
Memory DoS via subscription flood of unique topicsGHSA-4f8r-922h-2vgv published
May 16, 2026 by tabcatHigh