EUVD-2026-65154Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable relay server requires no authentication; impact is purely availability via listener exhaustion, with no confidentiality or integrity loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
AnalysisAI
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The reservation-store.ts reservation refresh path reuses an existing retimeableSignal but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running a js-libp2p node configured as a circuit-relay-v2 relay server - nodes acting solely as clients or ordinary peers are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the threat profile: network-reachable with no authentication, low complexity, and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connects to a js-libp2p relay server as a valid peer and repeatedly sends RESERVE protocol messages for the same relay slot in a tight loop. Each message is valid and processed normally by the server, which refreshes the reservation and attaches a new abort listener to the reused signal without removing the previous one. … |
| Remediation | Upgrade the `@libp2p/circuit-relay-v2` package to version 4.2.9 or later, which contains the fix at commit 4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, implement per-peer connection rate limiting and request throttling on all circuit-relay-v2 relay deployments, enable system monitoring for memory consumption and abort listener accumulation, and restrict relay network access to trusted peers if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today