Js Libp2P
Monthly
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust memory and deny service by repeatedly sending valid RESERVE requests for the same reservation slot. The `reservation-store.ts` reservation refresh path reuses an existing `retimeableSignal` but unconditionally registers a new abort listener on every call, causing listeners and their closures to grow without bound. No authentication is required to trigger this, making it exploitable by any peer that can reach the relay server. No public exploit or CISA KEV listing exists at time of analysis, though the unauthenticated network vector and trivial trigger condition make it a credible operational risk for relay operators.