Improper Verification of Cryptographic Signature

Overview @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validateToRawMessage process. An attacker can cause messages to be accepted and propagated as if authored by a vict...

GHSA-C3GV-825Q-FVMP libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Summary @libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key,...

PT-2026-94369

Name of the Vulnerable Software and Affected Versions @libp2p/gossipsub versions 15.0.0 through 16.0.4 Description In the default StrictSign policy, the validateToRawMessage function in packages/gossipsub/src/utils/buildRawMessage.ts fails to bind the supplied public key in msg.key to the claimed...