What is the CVSS score of CVE-2026-49866?

CVE-2026-49866 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of libp2p gossipsub are affected by CVE-2026-49866?

@libp2p/gossipsub (all versions prior to 16.0.0) is vulnerable to remote, unauthenticated denial of service when any connected network peer sends oversized control messages, freezing Node.js…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49866?

Yes, a public proof-of-concept exploit is available for CVE-2026-49866. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-49866?

Within 24 hours: Inventory all systems using @libp2p/gossipsub to assess exposure scope. Within 7 days: Test upgrade to @libp2p/gossipsub version 16.0.0 or later in non-production environments and validate P2P network connectivity. Within 30 days: Deploy patched version to all production systems and confirm operational stability.

libp2p gossipsub CVE-2026-49866

EUVD-2026-42409 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-08 security-advisories@github.com

GHSA-cwc9-cp4j-mcvv

Denial Of Service Node.js

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Any connected peer can remotely trigger event-loop blocking without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 22:04 EUVD

Analysis Generated

Jul 08, 2026 - 21:38 vuln.today

DescriptionCVE.org

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.

Articles & Coverage 1

News 5 New Node.js Vulnerabilities - 1 Critical, 4 High Severity Jul 09, 2026

AnalysisAI

Remote denial of service in the JavaScript @libp2p/gossipsub module (all versions prior to 16.0.0) lets any connected peer stall a victim node by sending oversized IHAVE/IWANT control messages. Because defaultDecodeRpcLimits left maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity, a single 4 MB RPC frame forces roughly 180,000 message IDs to be iterated synchronously, blocking the Node.js event loop and freezing the process. No public exploit identified at time of analysis; the flaw is remotely reachable without authentication against affected default configurations.

Technical ContextAI

libp2p is a modular peer-to-peer networking stack; gossipsub is its scalable publish/subscribe routing protocol used to disseminate messages across a mesh of peers. Peers exchange gossip via control messages, notably IHAVE (announcing message IDs a peer holds) and IWANT (requesting specific message IDs). These arrays are decoded in message/decodeRpc.ts and processed in gossipsub.ts. The vulnerability is a classic CWE-770 (Allocation of Resources Without Limits or Throttling): the RPC decode limit table (defaultDecodeRpcLimits) capped most fields but left maxIhaveMessageIDs and maxIwantMessageIDs at Infinity, so an attacker can pack a full protocol frame (~4 MB) with roughly 180,000 IDs that are iterated synchronously on the single-threaded Node.js event loop, starving all other work.

RemediationAI

Vendor-released patch: upgrade @libp2p/gossipsub to 16.0.0, which sets finite bounds for maxIhaveMessageIDs and maxIwantMessageIDs in defaultDecodeRpcLimits (fix commit https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899 via PR https://github.com/libp2p/js-libp2p/pull/3520, per advisory GHSA-cwc9-cp4j-mcvv). If you cannot upgrade immediately, the effective compensating control is to override the RPC decode limits in your gossipsub configuration so that maxIhaveMessageIDs and maxIwantMessageIDs are set to finite values (mirroring the upstream fix), which caps the per-frame iteration; the trade-off is that legitimately large gossip batches beyond the cap will be truncated. Where feasible, also restrict which peers can connect to the pubsub mesh (peer allow-listing or running on a permissioned network) to limit who can send control messages, accepting reduced openness of the mesh.