CVE-2026-46679highCWE-20CWE-400CWE-401

CVE-2026-46679: falha de alta gravidade em libp2p js-libp2p

libp2p: Memory DoS via subscription flood of unique topics

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar js-libp2p+ Monitorar @libp2p/gossipsub

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.3%
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
libp2p · js-libp2p
CVEs relacionadas — libp2p js-libp2p

No mesmo produto, das mais perigosas para as menos.

CVE-2022-23487HIGHlibp2p denial of service vulnerability from lack of resource managementEPSS 0.7%CVE-2026-86040HIGHlibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSEPSS 0.7%CVE-2026-49866HIGHlibp2p: CPU DoS via oversized IHAVE and IWANT control message arraysEPSS 0.6%CVE-2026-77384HIGHlibp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustionEPSS 0.6%CVE-2026-103936HIGHlibp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listenersEPSS 0.5%CVE-2026-45783HIGHlibp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodesEPSS 0.4%