Improper Verification of Cryptographic Signature

Overview @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validateToRawMessage process. An attacker can cause messages to be accepted and propagated as if authored by a vict...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +44 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.1.0, =1.2.0, =2.0.1, =2.0.2 - @ipshipyard/libp2p-inspector 2.0.1 - @ipshipyard/libp2p-inspector-metrics 2.0.0 and more Source cves: CVE-2026-86038 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-2004496...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +44 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.1.0, =1.2.0, =2.0.1, =2.0.2 - @ipshipyard/libp2p-inspector 2.0.1 - @ipshipyard/libp2p-inspector-metrics 2.0.0 and more Source cves: CVE-2026-86038 Source advisory: GHSA-C3GV-825Q-FVMP...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +44 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.1.0, =1.2.0, =2.0.1, =2.0.2 - @ipshipyard/libp2p-inspector 2.0.1 - @ipshipyard/libp2p-inspector-metrics 2.0.0 and more Source cves: CVE-2026-86038 Source advisory: OSV:GHSA-C3GV-825Q-FVMP...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +44 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.1.0, =1.2.0, =2.0.1, =2.0.2 - @ipshipyard/libp2p-inspector 2.0.1 - @ipshipyard/libp2p-inspector-metrics 2.0.0 and more Source cves: CVE-2026-86038 Source advisory: MEND:CVE-2026-86038...

EUVD-2026-81685

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-86038

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

PT-2026-94369

Name of the Vulnerable Software and Affected Versions @libp2p/gossipsub versions 15.0.0 through 16.0.4 Description In the default StrictSign policy, the validateToRawMessage function in packages/gossipsub/src/utils/buildRawMessage.ts fails to bind the supplied public key in msg.key to the claimed...

CVE-2026-86038: Insufficient Verification of Data Authenticity

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

@libp2p/daemon (>=6.0.27-160a24585, <=6.0.27-b7c6dc0f2), @libp2p/daemon-server (>=9.0.27-160a24585, <=9.0.27-b7c6dc0f2) potentially affected by CVE-2026-49866 via @libp2p/gossipsub (>=16.0.0-160a24585, <=16.0.0-b7c6dc0f2)

@libp2p/gossipsub NPM version =16.0.0-160a24585, =6.0.27-160a24585, =9.0.27-160a24585, =9.0.27-b7c6dc0f2 Source cves: CVE-2026-49866 Source advisory: GHSA-CWC9-CP4J-MCVV...

@libp2p/daemon (>=6.0.27-160a24585, <=6.0.27-b7c6dc0f2), @libp2p/daemon-server (>=9.0.27-160a24585, <=9.0.27-b7c6dc0f2) potentially affected by CVE-2026-49866 via @libp2p/gossipsub (>=16.0.0-160a24585, <=16.0.0-b7c6dc0f2)

@libp2p/gossipsub NPM version =16.0.0-160a24585, =6.0.27-160a24585, =9.0.27-160a24585, =9.0.27-b7c6dc0f2 Source cves: CVE-2026-49866 Source advisory: OSV:GHSA-CWC9-CP4J-MCVV...

@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-49866 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.23-d59c165ac)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-49866 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-17901717...

CVE-2026-49866

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...

CVE-2026-49866

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +44 more potentially affected by CVE-2026-49866 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=16.0.0-b7c6dc0f2)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.1.0, =1.2.0, =2.0.1, =2.0.2 - @ipshipyard/libp2p-inspector 2.0.1 - @ipshipyard/libp2p-inspector-metrics 2.0.0 and more Source cves: CVE-2026-49866 Source advisory: MEND:CVE-2026-49866...

CVE-2026-49866: Allocation of Resources Without Limits or Throttling

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronousl...

CVE-2026-46679

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23...

@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-46679 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.23-ed1ad1f26)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-46679 Source advisory: MEND:CVE-2026-46679...

CVE-2026-46679: Improper Input Validation

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23...

@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-46679 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.22-cc151e147)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-46679 Source advisory: GHSA-4F8R-922H-2VGV...