@libp2p/gossipsub vulnerabilities
CVEs whose affected-version data names the @libp2p/gossipsub package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-86038High· 7.5PoClibp2p is a JavaScript implementation of the libp2p networking stack
libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies …
▾ Midnightlibp2p · @libp2p/gossipsubEPSS 0.16%via NVD
CVE-2026-49866High· 7.5libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
▾ Twilightlibp2p · @libp2p/gossipsubEPSS 0.63%via GHSA