Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@libp2p/gossipsub

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
17.2.1 (Oct 19, 2026): no advisory affects it
Newest unaffected release
17.2.1 (Oct 19, 2026), the latest release
Advisories
3 · 3 high
Weekly downloads
15.3K
Dependents
13
Releases
215 since 14.1.1 (Sep 20, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-86038
    Affects 15.0.0 to 16.0.5-e86b39e5d (16.0.5 is outside it)
  • CVE-2026-49866
    Affects 14.1.1-6059227cb to 16.0.0-b7c6dc0f2 (16.0.0 is outside it)
  • CVE-2026-46679
    Affects 14.1.1-6059227cb to 15.0.23-ed1ad1f26 (15.0.23 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

    Affected: from 15.0.0, fixed in 16.0.5.

    Fixed in 16.0.5 (released Jul 19, 2026, 60 days before disclosure).

    The latest release, 17.2.1, is not affected.

    46% of @libp2p/gossipsub downloads last week were affected versions (7.8K).

  • libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

    Affected: fixed in 16.0.0.

    Fixed in 16.0.0 (released May 27, 2026, 42 days before disclosure).

    The latest release, 17.2.1, is not affected.

    26% of @libp2p/gossipsub downloads last week were affected versions (4.5K).

  • libp2p: Memory DoS via subscription flood of unique topics

    Affected: fixed in 15.0.23.

    Fixed in 15.0.23 (released May 16, 2026, 25 days before disclosure).

    The latest release, 17.2.1, is not affected.

    8.3% of @libp2p/gossipsub downloads last week were affected versions (1.4K).