CVE-2026-77384
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in libp2p (JavaScript) before version 4.2.9: the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. A remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service.
Risk Assessment
An attacker can cause overload of relay servers, leading to unavailability of network services.
Recommendation
Update libp2p to version 4.2.9 or later, which contains the fix.
Other vulnerabilities in libp2p
See all- CVE-2026-49866High
A vulnerability in the libp2p JavaScript library prior to version 16.0.0 allowed blocking the Node.js event loop by sending specially crafted IHAVE and IWANT messages. Missing limits in defaultDecodeRpcLimits (maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity) enabled iterating approximately 180,000 message IDs per 4 MB frame, leading to denial of service (DoS).
- CVE-2026-45783High
A vulnerability in the libp2p JavaScript library allows an unauthenticated remote attacker to exhaust disk storage of any @libp2p/kad-dht node running in server mode. The attack sends an unbounded stream of PUT_VALUE messages with keys that bypass content validation.
Original NVD description (English source)
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.