Missing Release of Memory after Effective Lifetime

Overview @libp2p/floodsub is a libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming it just floods the network. Affected versions of this package are vulnerable to Missing Releas...

CVE-2026-86040

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-86040

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

@0xvaibhav/--core (>=1.0.0, <=1.0.4), @0xvaibhav/divergent-node (>=0.0.1, <=0.0.3) +123 more potentially affected by CVE-2026-86040 via @libp2p/floodsub (>=1.0.7, <=10.1.46)

@libp2p/floodsub NPM version =1.0.7, =1.0.0, =0.0.1, =1.0.3, =1.9.15, =1.0.1, =1.2.0, =1.0.0, =1.0.0-rc.3, =0.0.1, =0.0.10, =0.0.14, =1.0.0, =1.2.26 and more Source cves: CVE-2026-86040 Source advisory: MEND:CVE-2026-86040...

EUVD-2026-81688

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-86040

CVE-2026-86040 affects @libp2p/floodsub in the libp2p JavaScript networking stack, prior to version 11.0.26 . The vulnerability stems from unauthenticated RPC frames on /floodsub/1.0.0 being decoded without protobuf element limits, and the subscription array being processed synchronously without ...

CVE-2026-86040: Uncontrolled Resource Consumption

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

PT-2026-94371

Name of the Vulnerable Software and Affected Versions libp2p versions prior to 11.0.26 Description @libp2p/floodsub accepts unauthenticated RPC frames on the '/floodsub/1.0.0' endpoint through PeerStreams.attachInboundStream without protobuf element limits. Subsequently, processRpc and...