High severity · published Aug 24, 2026
CVE-2026-77384
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
js-libp2p · libp2p
>= 2.1.5, < 4.2.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77384
github.com
https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d
github.com
https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9
github.com
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7
More from js-libp2p
8.2
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
7.5
CVE-2026-103936
libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
7.5
CVE-2026-86040
libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
7.5
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
7.5
CVE-2026-49866
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays