libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-86038 · Microsoft / collected KEV context

EUVD-2026-81685

GHSA-c3gv-825q-fvmp

cve-program · CVE-2026-86038

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp
• https://github.com/libp2p/js-libp2p/pull/3569
• https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f
• https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5

euvd · EUVD-2026-81685

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp
• https://github.com/libp2p/js-libp2p/pull/3569
• https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f
• https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5

nvd · CVE-2026-86038

• https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f
• https://github.com/libp2p/js-libp2p/pull/3569
• https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp

osv · GHSA-c3gv-825q-fvmp

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp
• https://github.com/libp2p/js-libp2p/pull/3569
• https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f
• https://github.com/libp2p/js-libp2p
• https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5

No related operational record is retained in the current change model.