libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-86039 · Microsoft / collected KEV context

EUVD-2026-81686

GHSA-vrf4-mx87-p53w

cve-program · CVE-2026-86039

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24

euvd · EUVD-2026-81686

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24

nvd · CVE-2026-86039

• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w

osv · GHSA-vrf4-mx87-p53w

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24

No related operational record is retained in the current change model.