{"id":"EUVD-2026-42409","enisaUuid":"9adeef46-ad5c-3e51-a314-635b8e971d3c","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.","datePublished":"Jul 8, 2026, 8:47:09 PM","dateUpdated":"Jul 9, 2026, 2:40:44 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv\nhttps://github.com/libp2p/js-libp2p/pull/3520\nhttps://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899\nhttps://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0\n","aliases":"CVE-2026-49866\nGHSA-cwc9-cp4j-mcvv\n","assigner":"GitHub_M","epss":0.63,"enisaIdProduct":[{"id":"735b94dd-e72a-34f6-a7d8-27a05fc600f5","product":{"name":"js-libp2p","vendor":{"name":"libp2p"}},"product_version":"\u003c 16.0.0"}],"enisaIdVendor":[{"id":"e77c5ad8-d8b5-386f-a308-bb1801a72b97","vendor":{"name":"libp2p"}}],"enisaIdVulnerability":[{"id":"6d254669-fb20-3e73-8ce7-10ead671006e","vulnerability":{"id":"CVE-2026-49866","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.","datePublished":"Jul 8, 2026, 8:47:09 PM","dateUpdated":"Jul 9, 2026, 2:40:44 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv\nhttps://github.com/libp2p/js-libp2p/pull/3520\nhttps://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899\nhttps://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0\n","enisa_id":"EUVD-2026-42409\n","assigner":"GitHub_M","epss":0.63,"dataProcessed":"Nov 5, 2026, 7:19:06 AM","vulnerabilityProduct":[{"id":"336bb9b7-ade3-32e2-b3db-75547c85d585","product":{"name":"js-libp2p","vendor":{"name":"libp2p"}},"product_version":"\u003c 16.0.0"}],"vulnerabilityVendor":[{"id":"fe8daa0d-7386-31f2-8667-4e6aa3fb8a5f","vendor":{"name":"libp2p"}}]}},{"id":"d94278ef-dcf6-3082-bf84-80e9c5893be5","vulnerability":{"id":"GHSA-cwc9-cp4j-mcvv","description":"libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays","datePublished":"Jul 10, 2026, 4:04:49 PM","dateUpdated":"Jul 10, 2026, 4:04:49 PM","baseScore":0.0,"references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49866\nhttps://github.com/libp2p/js-libp2p/pull/3520\nhttps://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899\nhttps://github.com/libp2p/js-libp2p\nhttps://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0\n","enisa_id":"EUVD-2026-42409\n","aliases":"GHSA-cwc9-cp4j-mcvv\nCVE-2026-49866\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}