{"id":"EUVD-2026-36152","enisaUuid":"879a763f-cff1-3064-97ca-3394f584a3ed","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.","datePublished":"Jun 10, 2026, 9:08:52 PM","dateUpdated":"Jun 11, 2026, 2:18:41 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv\n","aliases":"CVE-2026-46679\nGHSA-4f8r-922h-2vgv\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"50fadfdc-809a-3341-8caf-6a1897c9f21d","product":{"name":"js-libp2p","vendor":{"name":"libp2p"}},"product_version":"\u003c 15.0.23"}],"enisaIdVendor":[{"id":"d760a7c4-39f3-31e7-8c9a-ac45ba7aefce","vendor":{"name":"libp2p"}}],"enisaIdVulnerability":[{"id":"0b0cc5de-b253-3e4c-bd5e-d333c9758379","vulnerability":{"id":"GHSA-4f8r-922h-2vgv","description":"js-libp2p: Memory DoS via subscription flood of unique topics","datePublished":"May 21, 2026, 9:38:40 PM","dateUpdated":"Jun 11, 2026, 2:06:22 PM","baseScore":0.0,"references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46679\nhttps://github.com/libp2p/js-libp2p\n","enisa_id":"EUVD-2026-36152\n","aliases":"GHSA-4f8r-922h-2vgv\nCVE-2026-46679\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"38e00be4-fee0-37cd-87c1-6f761e88c009","vulnerability":{"id":"CVE-2026-46679","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.","datePublished":"Jun 10, 2026, 9:08:52 PM","dateUpdated":"Jun 11, 2026, 2:18:41 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv\n","enisa_id":"EUVD-2026-36152\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 28, 2026, 7:17:57 AM","vulnerabilityProduct":[{"id":"f463005f-d55f-3b05-967d-6a6594b3e720","product":{"name":"js-libp2p","vendor":{"name":"libp2p"}},"product_version":"\u003c 15.0.23"}],"vulnerabilityVendor":[{"id":"1272723c-020b-3e5f-bd61-7cce2c6f5a4c","vendor":{"name":"libp2p"}}]}}],"enisaIdAdvisory":[]}