JS
Product
js-libp2p
8
CVEs
0
On KEV
8.2
Max CVSS
1
New 30D
Severity mix
Critical 0High 8Medium 0Low 0
Watch
Add js-libp2p to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86039 | 8.2 | Sep 17 | libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses Affected: >= 8.0.0, < 12.0.24 |
| CVE-2026-103936 | 7.5 | Oct 15 | libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners Affected: < 3.3.7 |
| CVE-2026-86040 | 7.5 | Sep 17 | libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS Affected: < 11.0.26 |
| CVE-2026-86038 | 7.5 | Sep 17 | libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID Affected: >= 15.0.0, < 16.0.5 |
| CVE-2026-77384 | 7.5 | Aug 24 | libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion Affected: >= 2.1.5, < 4.2.9 |
| CVE-2026-49866 | 7.5 | Jul 8 | libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays Affected: < 16.0.0 |
| CVE-2026-45783 | 7.5 | Jun 10 | libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes Affected: < 16.2.6 |
| CVE-2026-46679 | 7.5 | Jun 10 | libp2p: Memory DoS via subscription flood of unique topics Affected: < 15.0.23 |
Showing 8