3id-test-helper (>=1.0.0 <=1.0.4), @0xvaibhav/--core (>=1.0.0 <=1.0.4) +226 more potentially affected by CVE-2022-23487 via libp2p (>=0.27.4 <=0.37.3)

libp2p NPM version =0.27.4, =1.0.0, =1.0.0, =0.0.1, =0.9.139, =0.0.2, =0.0.1, =1.0.0, =1.9.40, =1.0.0-rc.3, =0.1.2-beta.2, =0.1.2-beta.2, =0.1.2-beta.2, =0.3.2, =0.5.2, =0.5.3 and more Source cves: CVE-2022-23487 Source advisory: OSV:GHSA-F44Q-634C-JVWV...

CVE-2022-23487 libp2p denial of service vulnerability from lack of resource management

js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than v0.38.0 of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of...

CVE-2022-23487

This CVE affects js-libp2p: versions older than v0.38.0 are vulnerable to targeted resource exhaustion attacks that stress memory management (allocation of large memory, risking host OS termination). The issue is described across multiple sources (e.g., Red Hat RH-CVE, NVD/NVD lists, OSV) as a de...