CVE-2026-46679 Details
Description
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
A denial-of-service vulnerability has been identified in the libp2p JavaScript implementation, specifically within the Gossipsub module, prior to version 15.0.23. The issue arises from three combined flaws that allow an unauthenticated peer to flood a Gossipsub node with subscription requests, exhausting the Node.js memory heap. This memory exhaustion leads to an out-of-memory crash, causing the application to terminate unexpectedly.
Users can update to libp2p version 15.0.23 or later, where this vulnerability has been patched. Additionally, for those who cannot immediately upgrade, a partial mitigation is to set the 'allowedTopics' option, which limits the number of topics an attacker can flood. However, this does not address the memory leak or the increased time taken to process disconnections.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libp2p | <= 15.0.22 (semver) |
CPE
Remediation
| |
| libp2p GossipSub | <= 15.0.22 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |