Home

Description

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

PUBLISHED Reserved 2026-05-15 | Published 2026-06-10 | Updated 2026-06-10 | Assigner GitHub_M




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-20: Improper Input Validation

CWE-400: Uncontrolled Resource Consumption

CWE-401: Missing Release of Memory after Effective Lifetime

Product status

< 15.0.23
affected

References

github.com/...libp2p/security/advisories/GHSA-4f8r-922h-2vgv

cve.org (CVE-2026-46679)

nvd.nist.gov (CVE-2026-46679)

Download JSON