PT-2026-42699 · Npm+2 · @Libp2P/Gossipsub+1

CVE-2026-46679

·

Published

2026-05-21

·

Updated

2026-06-10

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions libp2p versions prior to 15.0.23
Description Three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node using default options, leading to an Out-Of-Memory (OOM) crash. The issue stems from the following technical defects:
  1. The defaultDecodeRpcLimits.maxSubscriptions variable is set to Infinity, meaning there is no decode-level cap on subscription entries per RPC.
  2. The handleReceivedSubscription() function is unbounded; every unique topic string creates a new Map entry and Set object in this.topics without a per-peer count limit.
  3. The removePeer() function fails to delete empty Sets from this.topics after a peer disconnects, causing memory to be non-reclaimable for the lifetime of the process.
An attacker can exploit this by sending a 4MB LP frame containing hundreds of thousands of unique topic SUBSCRIBE entries. This results in significant heap growth (approximately 22x amplification) and blocks the event loop. Because subscription processing lacks score checks or penalties, a single peer can crash a Node.js process with a 1.5GB heap limit using approximately 68MB of total bandwidth in about 5 seconds at 100Mbps.
Recommendations Update to version 15.0.23. As a temporary mitigation, restrict the use of the @libp2p/gossipsub module by configuring opts.allowedTopics to cap the growth of topics per attacker.

Exploit

Fix

DoS

Memory Leak

Resource Exhaustion

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-401CWE-400CWE-20

Related Identifiers

CVE-2026-46679
GHSA-4F8R-922H-2VGV

Affected Products

@Libp2P/Gossipsub
Js-Libp2P