These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer. The vulnerability affects systems using libp2p-rendezvous and defenders should assess [truncated]
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circ [truncated]
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in v [truncated]
CVE-2026-46679 is a HIGH severity vulnerability in libp2p's gossipsub. Prior to version 15.0.23, three cooperating omissions allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
CVE-2026-45783 is a HIGH severity vulnerability in libp2p, a JavaScript Implementation of libp2p networking stack. An unauthenticated remote peer can exhaust a @libp2p/kad-dht node's disk storage by sending an unbounded stream of PUT_VALUE messages with crafted keys, making the node unavailable. This issue was patched in version 16.2.6.
CVE-2026-34219 is a high-severity vulnerability in the libp2p-rust Gossipsub implementation. Prior to version 0.49.4, a remotely reachable panic occurs in backoff expiry handling. An attacker can send a crafted PRUNE control message with a near-maximum backoff value, causing an overflow and panic when adding duration to instant. This issue is reachable from any Gossipsub peer over normal TCP + Noise + mpl [truncated]