PatchSiren cyber security CVE debrief

CVE-2026-46679 libp2p CVE debrief

CVE-2026-46679 is a HIGH severity vulnerability in libp2p's gossipsub. Prior to version 15.0.23, three cooperating omissions allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

Vendor: libp2p
Product: js-libp2p
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-10
Original CVE updated: 2026-06-11
Advisory published: 2026-06-10
Advisory updated: 2026-06-11

Who should care

Users of libp2p's gossipsub with default options are affected by this vulnerability. An unauthenticated peer can exploit this issue to exhaust the Node.js heap.

Technical summary

The vulnerability is caused by three cooperating omissions in @libp2p/gossipsub. This allows an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options.

Defensive priority

HIGH

Recommended defensive actions

Update libp2p to version 15.0.23 or later to patch the vulnerability.
Review and adjust gossipsub node configurations to prevent exploitation.

Evidence notes

CVE-2026-46679 has a CVSS score of 7.5 and is classified as HIGH severity. The vulnerability was published on 2026-06-10T22:17:00.300Z and modified on 2026-06-11T16:16:23.663Z.

Official resources

CVE-2026-46679 was published on 2026-06-10T22:17:00.300Z and modified on 2026-06-11T16:16:23.663Z.