CVE-2026-86040 in libp2p
Summary
by MITRE • 09/17/2026
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/src/peer-streams.ts without protobuf element limits, then processRpc and processRpcSubOpt in packages/floodsub/src/floodsub.ts synchronously process the subscriptions array without a per-frame cap. A single bounded-size frame can decode into millions of empty subscription entries that block the event loop, while hundreds of thousands of unique-topic SUBSCRIBE entries allocate PeerSet objects in this.topics that are not removed after peer removal or stop. Empty entries cause CPU exhaustion but do not grow this.topics; persistent memory growth requires unique topics. The subscription path bypasses message signature validation and the message-only processing queue, allowing a remote peer to cause sustained CPU denial of service, memory exhaustion, out-of-memory termination, and node unavailability. The issue is fixed in version 11.0.26.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in libp2p versions prior to 11.0.26 represents a critical flaw within the floodsub implementation of the JavaScript networking stack, specifically affecting the handling of unauthenticated Remote Procedure Call frames on the /floodsub/1.0.0 protocol. The core technical deficiency lies in the PeerStreams.attachInboundStream function located in packages/floodsub/src/peer-streams.ts, which fails to enforce protobuf element limits when parsing incoming RPC frames. This lack of input validation allows a remote peer to transmit a single frame with bounded size that decodes into millions of empty subscription entries. Because these entries are processed synchronously by the processRpc and processRpcSubOpt functions in packages/floodsub/src/floodsub.ts, they effectively block the JavaScript event loop. In asynchronous environments like Node.js, blocking the event loop prevents the processing of other I/O operations, leading to a severe degradation of service availability for all connected peers and applications relying on that node.
Beyond CPU exhaustion caused by the synchronous processing of excessive empty entries, the vulnerability introduces significant memory management issues related to topic subscriptions. When hundreds of thousands of unique-topic SUBSCRIBE entries are received, they allocate PeerSet objects within this.topics data structures. Crucially, these allocations are not properly cleaned up when a peer disconnects or stops communicating with the node. This leads to persistent and unbounded memory growth over time as long as diverse topics are subscribed to by malicious peers. The combination of CPU blocking from empty entries and continuous memory allocation from unique topic subscriptions creates a compound denial-of-service condition that can result in out-of-memory termination, rendering the libp2p node completely unavailable for legitimate traffic.
From a security architecture perspective, this vulnerability exploits several fundamental design oversights. The subscription path bypasses standard message signature validation mechanisms, allowing unauthenticated peers to inject malicious payloads directly into the processing pipeline without cryptographic verification of their identity or intent. Furthermore, by circumventing the message-only processing queue, these requests are handled with higher priority and immediacy than normal operational traffic, amplifying the impact on system stability. This behavior aligns with CWE-20 Improper Input Validation regarding the failure to restrict input size and structure, as well as CWE-400 Uncontrolled Resource Consumption where resources such as CPU cycles and memory are exhausted by an attacker-controlled input. The attack vector is classified under MITRE ATT&CK technique T1499 Endpoint Denial of Service: Resource Exhaustion: CPU Cycle specifically through event loop blocking in JavaScript environments, demonstrating how application-layer protocol flaws can lead to systemic infrastructure failure.
The remediation for this vulnerability was implemented in version 11.0.26 of the libp2p library. The fix addresses these issues by enforcing strict limits on protobuf element counts and introducing per-frame caps on subscription processing to prevent event loop blocking. Additionally, improvements were made to ensure that PeerSet objects are correctly removed from memory when peers disconnect, preventing persistent memory leaks associated with unique topic subscriptions. Organizations utilizing libp2p in their decentralized application architectures must upgrade immediately to version 11.0.26 or later to mitigate the risk of remote denial-of-service attacks. Until this update is applied, operators should consider implementing network-level rate limiting and deep packet inspection at the firewall or reverse proxy layer to restrict the volume of floodsub messages accepted from untrusted peers, thereby providing a compensating control against resource exhaustion attempts.