Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86038— libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Quick assessment

Affected
libp2p js-libp2p
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libp2p 是 libp2p 网络协议栈的 JavaScript 实现。在版本 15.0.0 至 16.0.5 中， 在 中使用了默认的 策略。其中， 函数会使用攻击者控制的 来验证签名，但当声称的作者是一个未内嵌公钥的 RSA 类型 Peer ID 时，该函数会跳过将该密钥与 进行绑定的校验。 未认证的 attackers（攻击者）可以将受害者的 RSA Peer ID 填入 ，使用攻击者自己的私钥对消息进行签名，并在 中提供攻击者的公钥，从而导致该消息被视为由受害者创建并被接受和传播。 任何依赖于 字段来执行

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86038

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Source: CVE Program / CVE List V5
Vulnerability Description
libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips binding that key to msg.from when the claimed author is an RSA peer ID that does not inline a public key. An unauthenticated attacker can place a victim RSA peer ID in msg.from, sign the message with the attacker's private key, and supply the attacker's public key in msg.key, causing the message to be accepted and propagated as authored by the victim. Applications that trust message.from for validators, authorization, accounting, moderation, reputation, or audit logging can process attacker-controlled data under false origin attribution. The issue is fixed in version 16.0.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libp2p js-libp2p >= 15.0.0, < 16.0.5 -

II. Public POCs for CVE-2026-86038

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86038

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86038 (2)

Vendor Advisories for CVE-2026-86038 (1)

Vendor Pages for CVE-2026-86038 (1)

Same Patch Batch · libp2p · 2026-09-17 · 3 CVEs total

CVE-2026-86039 8.2 HIGH libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores cert
CVE-2026-86040 7.5 HIGH libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub all

IV. Related Vulnerabilities

Same product: js-libp2p
Same vendor: libp2p
Same weakness: CWE-345

V. Comments for CVE-2026-86038

No comments yet

Leave a comment