User Impersonation

Overview @libp2p/peer-store is a Stores information about peers libp2p knows on the network Affected versions of this package are vulnerable to User Impersonation via consumePeerRecord in peer-store/src/index.ts, where the peer ID derived from the envelope's signing public key is compared against...

8004skill (>=1.1.0, <=2.0.0), @a3stack/identity (0.2.0) +531 more potentially affected by CVE-2026-86039 via @libp2p/peer-store (>=8.2.1, <=12.0.23-89335e39f)

@libp2p/peer-store NPM version =8.2.1, =1.1.0, =0.0.1, =0.0.1, =1.0.0, =0.2.1, =0.3.1, =0.2.1, =0.4.1, =1.3.0, =0.0.2, =1.1.3, =1.1.8 - @artur-abliazimov/othentic-cli 1.16.6 and more Source cves: CVE-2026-86039 Source advisory: SNYK:JS-LIBP2PPEERSTORE-20044965...

8004skill (>=1.1.0, <=2.0.0), @a3stack/identity (0.2.0) +531 more potentially affected by CVE-2026-86039 via @libp2p/peer-store (>=8.2.1, <=12.0.23-89335e39f)

@libp2p/peer-store NPM version =8.2.1, =1.1.0, =0.0.1, =0.0.1, =1.0.0, =0.2.1, =0.3.1, =0.2.1, =0.4.1, =1.3.0, =0.0.2, =1.1.3, =1.1.8 - @artur-abliazimov/othentic-cli 1.16.6 and more Source cves: CVE-2026-86039 Source advisory: OSV:GHSA-VRF4-MX87-P53W...

CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

PT-2026-94370

Name of the Vulnerable Software and Affected Versions @libp2p/peer-store versions 8.0.0 through 12.0.23 Description In the @libp2p/peer-store component, the consumePeerRecord function verifies a RecordEnvelope signature but fails to ensure that the PeerRecord.peerId within the signed payload...

CVE-2026-86039: Authentication Bypass by Spoofing

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...