EUVD-2026-42409
GHSA-cwc9-cp4j-mcvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect as libp2p peer
-
DeliveryJoin gossipsub mesh
-
ExploitSend 4 MB IHAVE/IWANT frame
-
ExecutionForce synchronous iteration of ~180k IDs
-
PersistBlock Node.js event loop
-
ImpactNode unresponsive (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run @libp2p/gossipsub below 16.0.0 with the default decode limits (maxIhaveMessageIDs/maxIwantMessageIDs at Infinity) and that the attacker be able to establish a libp2p connection and participate in the gossipsub pubsub mesh so it can deliver IHAVE/IWANT control messages. On open/public networks no authentication is needed (CVSS PR:N), so any reachable peer qualifies; the practical limiting factor is network reachability of the node's transport and any peer-gating (permissioned networks, allow-lists, or firewalls) that restricts who may connect and join the mesh. No user interaction and no elevated privileges are required. |
| Impact | The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - network-reachable, low complexity, no privileges or user interaction, pure availability impact. That vector is internally consistent with the description: an unauthenticated remote peer can trigger the condition, and confidentiality and integrity are untouched. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is a real but availability-only issue rather than a code-execution emergency; priority should scale with how exposed the node's gossipsub interface is. One caveat worth verifying: in many libp2p deployments a peer must first establish a connection and join the pubsub mesh, which is trivial in open networks but may be gated in permissioned/private networks - that deployment context, not the CVSS score alone, determines real exposure. |
| Exploit ScenarioDerived | An attacker connects to a target js-libp2p node running an unpatched @libp2p/gossipsub and joins the gossip mesh as an ordinary peer. They send a maximally sized (~4 MB) RPC frame whose IHAVE/IWANT arrays contain roughly 180,000 message IDs; the victim iterates the entire array synchronously, blocking its Node.js event loop and rendering the node unresponsive. Repeated frames sustain the outage. No public POC is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Remote denial of service in the JavaScript @libp2p/gossipsub module (all versions prior to 16.0.0) lets any connected peer stall a victim node by sending oversized IHAVE/IWANT control messages. Because defaultDecodeRpcLimits left maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity, a single 4 MB RPC frame forces roughly 180,000 message IDs to be iterated synchronously, blocking the Node.js event loop and freezing the process. No public exploit identified at time of analysis; the flaw is remotely reachable without authentication against affected default configurations.
RemediationAI
Vendor-released patch: upgrade @libp2p/gossipsub to 16.0.0, which sets finite bounds for maxIhaveMessageIDs and maxIwantMessageIDs in defaultDecodeRpcLimits (fix commit https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899 via PR https://github.com/libp2p/js-libp2p/pull/3520, per advisory GHSA-cwc9-cp4j-mcvv). If you cannot upgrade immediately, the effective compensating control is to override the RPC decode limits in your gossipsub configuration so that maxIhaveMessageIDs and maxIwantMessageIDs are set to finite values (mirroring the upstream fix), which caps the per-frame iteration; the trade-off is that legitimately large gossip batches beyond the cap will be truncated. Where feasible, also restrict which peers can connect to the pubsub mesh (peer allow-listing or running on a permissioned network) to limit who can send control messages, accepting reduced openness of the mesh.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libp2p is a modular peer-to-peer networking stack; gossipsub is its scalable publish/subscribe routing protocol used to disseminate messages across a mesh of peers. Peers exchange gossip via control messages, notably IHAVE (announcing message IDs a peer holds) and IWANT (requesting specific message IDs). These arrays are decoded in message/decodeRpc.ts and processed in gossipsub.ts. The vulnerability is a classic CWE-770 (Allocation of Resources Without Limits or Throttling): the RPC decode limit table (defaultDecodeRpcLimits) capped most fields but left maxIhaveMessageIDs and maxIwantMessageIDs at Infinity, so an attacker can pack a full protocol frame (~4 MB) with roughly 180,000 IDs that are iterated synchronously on the single-threaded Node.js event loop, starving all other work.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Any connected peer can remotely trigger event-loop blocking without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H, C:N/I:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.
Articles & Coverage 1
Executive ViewAI
@libp2p/gossipsub (all versions prior to 16.0.0) is vulnerable to remote, unauthenticated denial of service when any connected network peer sends oversized control messages, freezing Node.js processes and directly impacting availability across distributed applications relying on this library.
Apply vendor patch: upgrade to @libp2p/gossipsub version 16.0.0 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB