Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

js-libp2p — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in js-libp2p, with AI-generated Chinese analysis, references, and POCs.

Vendor: libp2p

CVE ID Title CVSS Severity Published
CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners CWE-248 7.5 High 2026-10-15
CVE-2026-86040 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS CWE-400 7.5 High 2026-09-17
CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses CWE-290 8.2 High 2026-09-17
CVE-2026-86038 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID CWE-345 7.5 High 2026-09-17
CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion CWE-400 7.5 High 2026-08-24
CVE-2026-49866 libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays CWE-770 7.5 High 2026-07-08
CVE-2026-45783 libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes CWE-20 7.5 High 2026-06-10
CVE-2026-46679 libp2p: Memory DoS via subscription flood of unique topics CWE-20 7.5 High 2026-06-10
CVE-2022-23487 libp2p denial of service vulnerability from lack of resource management CWE-400 7.5 High 2022-12-07

All 9 known CVE vulnerabilities affecting js-libp2p with full Chinese analysis, references, and POCs where available.