Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86039— libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

Quick assessment

Affected
libp2p js-libp2p
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libp2p 是 libp2p 网络栈的 JavaScript 实现。在 8.0.0 到 12.0.24 版本中， （位于 ）在验证 签名时使用了 ，但并未强制要求签名负载中的 必须等于通过 推导出的签名者 Peer ID。 选项仅检查信封的签名者，而 gossipsub 的 Peer Exchange 路径允许攻击者将自己的 Peer ID 作为 传入。因此，攻击者可以用自己的密钥对记录进行签名，在负载中填入受害者的 Peer ID 和攻击者控制的多地址（multiaddrs），从而将经过认证的地址存储到受害者的

CVSS 8.2 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86039

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
Source: CVE Program / CVE List V5
Vulnerability Description
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libp2p js-libp2p >= 8.0.0, < 12.0.24 -

II. Public POCs for CVE-2026-86039

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86039

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86039 (2)

Vendor Advisories for CVE-2026-86039 (1)

Vendor Pages for CVE-2026-86039 (1)

Same Patch Batch · libp2p · 2026-09-17 · 3 CVEs total

CVE-2026-86040 7.5 HIGH libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub all
CVE-2026-86038 7.5 HIGH libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

IV. Related Vulnerabilities

Same product: js-libp2p
Same vendor: libp2p
Same weakness: CWE-290

V. Comments for CVE-2026-86039

No comments yet

Leave a comment