libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

🗓️ 17 Sep 2026 18:01:38Reported by GitHub Advisory DatabaseType

Summary @libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope ...

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-86039	17 Sep 202618:19	–	circl
CVE	CVE-2026-86039	17 Sep 202615:19	–	cve
Cvelist	CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses	17 Sep 202615:19	–	cvelist
EUVD	EUVD-2026-81686	17 Sep 202615:19	–	euvd
NVD	CVE-2026-86039	17 Sep 202616:18	–	nvd
OSV	GHSA-VRF4-MX87-P53W libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses	17 Sep 202618:01	–	osv

Vulners

Node

libp2p peer-storeRange8.0.0–12.0.24npm

Source	Link
github	www.github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w
github	www.github.com/libp2p/js-libp2p/pull/3570
github	www.github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
github	www.github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24
github	www.github.com/advisories/GHSA-vrf4-mx87-p53w

17 Sep 2026 18:01Current

CVSS 3.18.2

EPSS0.00183