CVE-2026-49866
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in the libp2p JavaScript library prior to version 16.0.0 allowed blocking the Node.js event loop by sending specially crafted IHAVE and IWANT messages. Missing limits in defaultDecodeRpcLimits (maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity) enabled iterating approximately 180,000 message IDs per 4 MB frame, leading to denial of service (DoS).
Risk Assessment
An attacker can remotely halt a Node.js application using libp2p, disrupting processing of other requests and potentially causing complete service unavailability.
Recommendation
Immediately update the @libp2p/gossipsub library to version 16.0.0 or later, which introduces proper limits for IHAVE and IWANT message arrays.
Other vulnerabilities in libp2p
See all- CVE-2026-77384High
Vulnerability in libp2p (JavaScript) before version 4.2.9: the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. A remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service.
- CVE-2026-45783High
A vulnerability in the libp2p JavaScript library allows an unauthenticated remote attacker to exhaust disk storage of any @libp2p/kad-dht node running in server mode. The attack sends an unbounded stream of PUT_VALUE messages with keys that bypass content validation.
Original NVD description (English source)
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.