8004skill (>=1.1.0, <=2.0.0), @a3stack/identity (0.2.0) +531 more potentially affected by CVE-2026-86039 via @libp2p/peer-store (>=8.2.1, <=12.0.23-89335e39f)

@libp2p/peer-store NPM version =8.2.1, =1.1.0, =0.0.1, =0.0.1, =1.0.0, =0.2.1, =0.3.1, =0.2.1, =0.4.1, =1.3.0, =0.0.2, =1.1.3, =1.1.8 - @artur-abliazimov/othentic-cli 1.16.6 and more Source cves: CVE-2026-86039 Source advisory: SNYK:JS-LIBP2PPEERSTORE-20044965...

8004skill (>=1.1.0, <=2.0.0), @a3stack/identity (0.2.0) +531 more potentially affected by CVE-2026-86039 via @libp2p/peer-store (>=8.2.1, <=12.0.23-89335e39f)

@libp2p/peer-store NPM version =8.2.1, =1.1.0, =0.0.1, =0.0.1, =1.0.0, =0.2.1, =0.3.1, =0.2.1, =0.4.1, =1.3.0, =0.0.2, =1.1.3, =1.1.8 - @artur-abliazimov/othentic-cli 1.16.6 and more Source cves: CVE-2026-86039 Source advisory: OSV:GHSA-VRF4-MX87-P53W...

GHSA-VRF4-MX87-P53W libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

Summary @libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped...

User Impersonation

Overview @libp2p/peer-store is a Stores information about peers libp2p knows on the network Affected versions of this package are vulnerable to User Impersonation via consumePeerRecord in peer-store/src/index.ts, where the peer ID derived from the envelope's signing public key is compared against...

CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

CVE-2026-86039

CVE-2026-86039 affects @libp2p/peer-store (part of the JavaScript libp2p networking stack) from versions 8.0.0 through 12.0.24 . The root cause is in consumePeerRecord, which verifies a RecordEnvelope signature but fails to require that PeerRecord.peerId in the signed payload matches the signer p...

CVE-2026-86039 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

PT-2026-94370

Name of the Vulnerable Software and Affected Versions @libp2p/peer-store versions 8.0.0 through 12.0.23 Description In the @libp2p/peer-store component, the consumePeerRecord function verifies a RecordEnvelope signature but fails to ensure that the PeerRecord.peerId within the signed payload...

CVE-2026-86039: Authentication Bypass by Spoofing

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...

GHSA-GCQ9-QQWX-RGJ3 libp2p nodes vulnerable to OOM attack

Summary In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. It is feasible to do this at scale. An attacker would have to transfe...