Missing Release of Resource after Effective Lifetime

Overview @libp2p/circuit-relay-v2 is an Implementation of Circuit Relay v2 Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the reserve path in packages/transport-circuit-relay-v2/src/server/reservation-store.ts. An attacker can grow...

8004skill (>=1.1.0, <=2.0.0), @a3stack/identity (0.2.0) +225 more potentially affected by CVE-2026-77384 via @libp2p/circuit-relay-v2 (>=2.1.5, <=4.2.7)

@libp2p/circuit-relay-v2 NPM version =2.1.5, =1.1.0, =1.0.4, =1.0.0, =1.0.0, =1.0.1, =0.1.0-alpha.1, =1.0.0, =0.0.1, =0.0.1, =0.0.4, =0.0.1, =0.0.12 - @blockless/browser-node 0.1.1 - @bluzelle/sdk 1.0.25 and more Source cves: CVE-2026-77384 Source advisory: SNYK:JS-LIBP2PCIRCUITRELAYV2-19256805...

CVE-2026-77384

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

EUVD-2026-65154

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384

@libp2p/circuit-relay-v2 (part of the js-libp2p JavaScript networking stack) is vulnerable to a remote denial of service in its reservation refresh path within reservation-store.ts. Prior to version 4.2.9 , each refresh reuses the same retimeableSignal but unconditionally registers an additional ...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384: Uncontrolled Resource Consumption

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

PT-2026-81042

Name of the Vulnerable Software and Affected Versions libp2p versions prior to 4.2.9 Description In the reservation refresh path within reservation-store.ts, the software reuses the same retimeableSignal but unconditionally registers a new abort listener during every refresh. A remote peer can...