{"id":"EUVD-2026-42409","revision":"cfc56fc602ca4f9b9f8c360da061f65f","records":[{"revision":"cfc56fc602ca4f9b9f8c360da061f65f","observedAt":"2026-11-05T10:42:27.579+00:00","statement":{"source":"euvd","id":"EUVD-2026-42409","aliases":["CVE-2026-49866","GHSA-cwc9-cp4j-mcvv"],"title":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays…","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv","https://github.com/libp2p/js-libp2p/pull/3520","https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899","https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42409","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 8:47:09 PM","dateUpdated":"Jul 9, 2026, 2:40:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42409","identifiers":["EUVD-2026-42409","CVE-2026-49866","GHSA-cwc9-cp4j-mcvv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}