Js Libp2P
Monthly
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Address-book poisoning in the @libp2p/peer-store component of js-libp2p (8.0.0 up to, but not including, 12.0.24) allows an unauthenticated remote peer to store attacker-controlled multiaddrs as certified addresses under a victim peer ID, because consumePeerRecord validates only the RecordEnvelope signer and never checks that the signed PeerRecord.peerId matches the signer's own peer ID. The gossipsub Peer Exchange path makes this trivially reachable: it lets the attacker supply its own peer ID as the expectedPeer option while naming a victim in the signed payload, so the poisoned addresses are accepted and persisted for the victim, enabling dial redirection, dial failure, routing manipulation and reachability disruption. The connection upgrade still verifies the remote peer's true identity, so full identity takeover or traffic interception is not achieved; no public exploit identified at time of analysis, and the issue is fixed in peer-store 12.0.24 (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L, CWE-290).
Forged message authorship in @libp2p/gossipsub 15.0.0 through 16.0.4 lets an unauthenticated, remote attacker sign a gossipsub message with their own key while declaring a victim's RSA peer ID as the author (msg.from), so the message is accepted and propagated as if it came from the victim. The spoofing path is confined to RSA peer IDs that do not inline a public key, since Ed25519 and secp256k1 identities embed the key in the peer ID and cannot be impersonated this way. Impact is integrity-only: applications that make trust, authorization, accounting, moderation, reputation, or audit-log decisions on msg.from can act on attacker-controlled data under a false origin, while deployments that ignore claimed authorship are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fixed the issue in gossipsub 16.0.5 under CVSS 3.1 base 7.5.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Address-book poisoning in the @libp2p/peer-store component of js-libp2p (8.0.0 up to, but not including, 12.0.24) allows an unauthenticated remote peer to store attacker-controlled multiaddrs as certified addresses under a victim peer ID, because consumePeerRecord validates only the RecordEnvelope signer and never checks that the signed PeerRecord.peerId matches the signer's own peer ID. The gossipsub Peer Exchange path makes this trivially reachable: it lets the attacker supply its own peer ID as the expectedPeer option while naming a victim in the signed payload, so the poisoned addresses are accepted and persisted for the victim, enabling dial redirection, dial failure, routing manipulation and reachability disruption. The connection upgrade still verifies the remote peer's true identity, so full identity takeover or traffic interception is not achieved; no public exploit identified at time of analysis, and the issue is fixed in peer-store 12.0.24 (CVSS 8.2, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L, CWE-290).
Forged message authorship in @libp2p/gossipsub 15.0.0 through 16.0.4 lets an unauthenticated, remote attacker sign a gossipsub message with their own key while declaring a victim's RSA peer ID as the author (msg.from), so the message is accepted and propagated as if it came from the victim. The spoofing path is confined to RSA peer IDs that do not inline a public key, since Ed25519 and secp256k1 identities embed the key in the peer ID and cannot be impersonated this way. Impact is integrity-only: applications that make trust, authorization, accounting, moderation, reputation, or audit-log decisions on msg.from can act on attacker-controlled data under a false origin, while deployments that ignore claimed authorship are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fixed the issue in gossipsub 16.0.5 under CVSS 3.1 base 7.5.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.