CVE-2026-46679

7.5 Élevée

Publiée le 11/06/2026 à 00:17 · Modifiée le 23/07/2026 à 11:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

Traduire en français

Produits concernés

libp2p js-libp2p

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-20
CWE-400
CWE-401

Références

https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories