These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in v [truncated]
CVE-2026-46679 is a HIGH severity vulnerability in libp2p's gossipsub. Prior to version 15.0.23, three cooperating omissions allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
CVE-2026-45783 is a HIGH severity vulnerability in libp2p, a JavaScript Implementation of libp2p networking stack. An unauthenticated remote peer can exhaust a @libp2p/kad-dht node's disk storage by sending an unbounded stream of PUT_VALUE messages with crafted keys, making the node unavailable. This issue was patched in version 16.2.6.
CVE-2026-34219 is a high-severity vulnerability in the libp2p-rust Gossipsub implementation. Prior to version 0.49.4, a remotely reachable panic occurs in backoff expiry handling. An attacker can send a crafted PRUNE control message with a near-maximum backoff value, causing an overflow and panic when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mpl [truncated]