CVE-2026-95859

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...

CVE-2026-95859

The libp2p-rust networking stack (prior to version 0.49.5 ) contains a vulnerability in Gossipsub control-message handling. The root cause is that the system unconditionally adds attacker-supplied topic hashes to connected_peer.topics without verifying if the peer previously subscribed to them. A...

CVE-2026-95859 libp2p-rust: Gossipsub GRAFT topics unbounded growth

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...

CVE-2026-95859 libp2p-rust: Gossipsub GRAFT topics unbounded growth

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...

CVE-2026-95859: Allocation of Resources Without Limits or Throttling

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...

PT-2026-115630

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.5 Description In the official Rust implementation of the libp2p networking stack, the handling of Gossipsub GRAFT control messages allows the addition of attacker-supplied topic hashes to connected peer.topic...

GHSA-VRF4-MX87-P53W libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

Summary @libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped...

Improper Verification of Cryptographic Signature

Overview @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validateToRawMessage process. An attacker can cause messages to be accepted and propagated as if authored by a vict...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +28 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =2.0.1, =2.0.0, =6.0.1-425a42cdd, =9.0.0, =0.1.0, =10.0.0-rc.8, =0.0.1-dev.1773506972.23bf9c0, =10.0.24 and more Source cves: CVE-2026-86038 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-20044966...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +28 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =2.0.1, =2.0.0, =6.0.1-425a42cdd, =9.0.0, =0.1.0, =10.0.0-rc.8, =0.0.1-dev.1773506972.23bf9c0, =10.0.24 and more Source cves: CVE-2026-86038 Source advisory: OSV:GHSA-C3GV-825Q-FVMP...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +28 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =2.0.1, =2.0.0, =6.0.1-425a42cdd, =9.0.0, =0.1.0, =10.0.0-rc.8, =0.0.1-dev.1773506972.23bf9c0, =10.0.24 and more Source cves: CVE-2026-86038 Source advisory: GHSA-C3GV-825Q-FVMP...

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Summary @libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key,...

CVE-2026-86038

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-86039

CVE-2026-86039 affects @libp2p/peer-store (part of the JavaScript libp2p networking stack) from versions 8.0.0 through 12.0.24 . The root cause is in consumePeerRecord, which verifies a RecordEnvelope signature but fails to require that PeerRecord.peerId in the signed payload matches the signer p...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

@b0ase/path402-api (4.0.0-alpha.1), @b0ase/path402-core (4.0.0-alpha.2) +28 more potentially affected by CVE-2026-86038 via @libp2p/gossipsub (>=15.0.1-425a42cdd, <=16.0.5-e86b39e5d)

@libp2p/gossipsub NPM version =15.0.1-425a42cdd, =0.1.0, =2.0.1, =2.0.0, =6.0.1-425a42cdd, =9.0.0, =0.1.0, =10.0.0-rc.8, =0.0.1-dev.1773506972.23bf9c0, =10.0.24 and more Source cves: CVE-2026-86038 Source advisory: MEND:CVE-2026-86038...

CVE-2026-86038 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-86038 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-86038 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-86038

CVE-2026-86038 affects the @libp2p/gossipsub package (versions 15.0.0 through 16.0.5) in the JavaScript libp2p networking stack. The vulnerability resides in validateToRawMessage within the default StrictSign policy: when a claimed author is an RSA peer ID that does not inline a public key, the f...