CVE-2026-49866 Details
Description
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.
A denial-of-service vulnerability has been identified in the libp2p Gossipsub implementation for JavaScript, affecting versions through 15.0.23. The issue arises from the default settings of the 'decodeRpcLimits', which prior to version 16.0.0, allowed unlimited message IDs in IHAVE and IWANT control messages. This flaw enables a single peer to send large arrays of message IDs that can block the Node.js event loop for an extended period, disrupting normal operations. The vulnerability is particularly severe for IWANT messages, which lack any built-in rate limits.
Users can upgrade to libp2p Gossipsub version 16.0.0 or later, where this vulnerability has been addressed. Instructions for updating can be found in the libp2p documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899 | [email protected] | Source CodeVendor |
| https://github.com/libp2p/js-libp2p/pull/3520 | [email protected] | Source CodeVendor |
| https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0 | [email protected] | Release NotesVendor |
| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libp2p/js-libp2p | All versions |
CPE
Remediation
| |
| @libp2p/gossipsub | <= 15.0.23 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |