Seal

Seal 点对点、端到端加密聊天。 无收件箱。无账户需要恢复。没有人在监听——包括我们。 github.com/Emn4tor/Seal !G...

RendezvousRAT

信息 本仓库包含两个使用 GO 编写的最小概念验证 RAT，基于 go-libp2p-examples 中的示例。 目前，该 RAT 面向 Linux 主机。不过，可以通过修改 go build 变量来为 Windows 构建。 你可以在 Linux 中设置环境变量，告诉 GO 为 Windows 编译。"env GOOS=windows"，并将项目中的命令从 "sh -c" 改为 "cmd.exe /c"。这将在后续版本中实现。 RendezvousRAT 使用 libp2p 的自愈概念验证 RAT。 构建 RendezvousRAT 该项目由客户端和服务端组成。客户端必须能够访问服务...

CVE-2026-86038

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:04+00:00| published-proof-of-concept| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp...

User Impersonation

Overview @libp2p/peer-store is a Stores information about peers libp2p knows on the network Affected versions of this package are vulnerable to User Impersonation via consumePeerRecord in peer-store/src/index.ts, where the peer ID derived from the envelope's signing public key is compared against...

Missing Release of Memory after Effective Lifetime

Overview @libp2p/floodsub is a libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming it just floods the network. Affected versions of this package are vulnerable to Missing Releas...

Improper Verification of Cryptographic Signature

Overview @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validateToRawMessage process. An attacker can cause messages to be accepted and propagated as if authored by a vict...

GHSA-C3GV-825Q-FVMP libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Summary @libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key,...

CVE-2026-86040

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86040 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-86040 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

EUVD-2026-81688

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and...

CVE-2026-86040

CVE-2026-86040 affects @libp2p/floodsub in the libp2p JavaScript networking stack, prior to version 11.0.26 . The vulnerability stems from unauthenticated RPC frames on /floodsub/1.0.0 being decoded without protobuf element limits, and the subscription array being processed synchronously without ...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86039

CVE-2026-86039 affects @libp2p/peer-store (part of the JavaScript libp2p networking stack) from versions 8.0.0 through 12.0.24 . The root cause is in consumePeerRecord, which verifies a RecordEnvelope signature but fails to require that PeerRecord.peerId in the signed payload matches the signer p...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

EUVD-2026-81686

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

EUVD-2026-81685

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-86038 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...