PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-86039 libp2p CVE debrief

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

Vendor
libp2p
Product
js-libp2p
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-17
Original CVE updated
2026-09-21
Advisory published
2026-09-17
Advisory updated
2026-09-21

Who should care

Defenders responsible for libp2p deployments should assess exposure and verify libp2p versions. System administrators and security teams should review and monitor libp2p peer-store configurations.

Why it matters

Defenders should prioritize verifying and updating libp2p to version 12.0.24 or later to prevent potential address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption. Libp2p deployments should review and monitor peer-store configurations to detect potential security issues.

  • Address-book corruption due to poisoned addresses
  • Dial redirection or failure due to manipulated addresses
  • Routing manipulation through compromised peer records
  • Reachability disruption due to certified addresses for victims

Technical summary

The libp2p peer-store module incorrectly verifies RecordEnvelope signatures, allowing an attacker to sign a record with their key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. This issue can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption. The vulnerability is fixed in version 12.0.24, and defenders should prioritize verifying and updating libp2p to prevent potential security issues.

Defensive priority

Defenders should prioritize verifying and updating libp2p to version 12.0.24 or later to prevent potential address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption.

Recommended defensive actions

  • Verify and update libp2p to version 12.0.24 or later
  • Review and monitor libp2p peer-store configurations
  • Implement additional monitoring and logging for libp2p peer interactions
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references provide details on the vulnerability in libp2p. The issue is fixed in version 12.0.24. Defenders should verify libp2p versions and review peer-store configurations. Evidence is limited to public CVE details and source references, which may not cover all affected systems or variations. Additional verification tasks are recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-86039 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-86039

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-86039 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86039

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.