Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-49866libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

High 7.5

In plain English

A high-severity resource allocation without limits in js-libp2p from libp2p. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@libp2p/gossipsub	16.0.0	GHSA-cwc9-cp4j-mcvv

Affected products (as reported)

Vendor	Product	Versions
libp2p	js-libp2p	< 16.0.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv x_refsource_CONFIRM
https://github.com/libp2p/js-libp2p/pull/3520 x_refsource_MISC
https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899 x_refsource_MISC
https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0 x_refsource_MISC