Libp2p - vulnerabilities (CVEs)

26 CVEs in 11 products, 2 in the last 30 days, newest from 2026-10-16.

Products

• Js-libp2p - 9 CVEs
• Rust-libp2p - 7 CVEs
• Go-libp2p - 3 CVEs
• Rust-yamux - 3 CVEs
• Py-libp2p - 2 CVEs
• Floodsub - 1 CVEs
• Libp2p - 1 CVEs
• Libp2p-deflate - 1 CVEs
• Rust Yamux - 1 CVEs
• Webrtc - 1 CVEs
• Libp2p-gossipsub - 0 CVEs

Newest CVEs of Libp2p

• CVE-2026-95859 - CVSS 8.7 (high), 2026-10-16: libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling…
• CVE-2026-103936 - CVSS 7.5 (high), 2026-10-15: libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes…
• CVE-2026-86040 - CVSS 7.5 (high), 2026-09-17: libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0…
• CVE-2026-86039 - CVSS 8.2 (high), 2026-09-17: libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses…
• CVE-2026-86038 - CVSS 7.5 (high), 2026-09-17: libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in…
• CVE-2026-61544 - CVSS 8.2 (high), 2026-09-15: libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC…
• CVE-2026-77384 - CVSS 7.5 (high), 2026-08-24: libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the…
• CVE-2026-73568 - CVSS 7.5 (high), 2026-08-13: py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in…
• CVE-2026-49866 - CVSS 7.5 (high), 2026-07-08: libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and…
• CVE-2026-46679 - CVSS 7.5 (high), 2026-06-10: libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an…
• CVE-2026-45783 - CVSS 7.5 (high), 2026-06-10: libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any…
• CVE-2026-35457 - CVSS 8.2 (high), 2026-04-07: libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies…
• CVE-2026-35405 - CVSS 7.5 (high), 2026-04-07: libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many…
• CVE-2026-34219 - CVSS 8.2 (high), 2026-03-31: libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation…
• CVE-2026-33040 - CVSS 8.7 (high), 2026-03-20: libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts…
• CVE-2026-32314 - CVSS 8.7 (high), 2026-03-16: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing…
• CVE-2026-31814 - CVSS 8.7 (high), 2026-03-13: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause…
• CVE-2025-29606 - CVSS 4.3 (medium), 2025-07-14: py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
• CVE-2024-32984 - CVSS 7.5 (high), 2024-05-01: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for…
• CVE-2023-40583 - CVSS 7.5 (high), 2023-08-25: libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed…
• CVE-2023-39533 - CVSS 7.5 (high), 2023-08-08: go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a…
• CVE-2022-23492 - CVSS 7.5 (high), 2022-12-08: go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource…
• CVE-2022-23487 - CVSS 7.5 (high), 2022-12-07: js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource…
• CVE-2022-23486 - CVSS 7.5 (high), 2022-12-07: libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node…
• CVE-2020-36443 - CVSS 9.8 (critical), 2021-08-08: An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a…
• CVE-2019-15545 - CVSS 7.5 (high), 2019-08-26: An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.