CVE-2026-46679

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) libp2p es una implementación de JavaScript de la pila de red libp2p. Antes de la versión 15.0.23, tres omisiones combinadas en @libp2p/gossipsub permiten que un único par no autenticado agote la memoria heap de Node.js de cualquier nodo gossipsub con las opciones predeterminadas. Este problema ha sido parcheado en la versión 15.0.23.

11 Jun 2026, 16:16

Type	Values Removed	Values Added
References	~~() https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv -~~	() https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv -

10 Jun 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 22:17

Updated : 2026-07-23 09:10

NVD link : CVE-2026-46679

Mitre link : CVE-2026-46679

CVE.ORG link : CVE-2026-46679

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-46679", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46679", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T14:18:10.380346Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libp2p", "product": "js-libp2p", "versions": [{"status": "affected", "version": "< 15.0.23"}]}]}], "published": "2026-06-10T22:17:00.300", "references": [{"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv", "source": "security-advisories@github.com"}, {"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23."}, {"lang": "es", "value": "libp2p es una implementaci\u00f3n de JavaScript de la pila de red libp2p. Antes de la versi\u00f3n 15.0.23, tres omisiones combinadas en @libp2p/gossipsub permiten que un \u00fanico par no autenticado agote la memoria heap de Node.js de cualquier nodo gossipsub con las opciones predeterminadas. Este problema ha sido parcheado en la versi\u00f3n 15.0.23."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security-advisories@github.com"}