CVE-2026-46679 libp2p: Memory DoS via subscription flood of unique topics
An unauthenticated peer can exhaust the Node.js heap of a gossipsub node by flooding unique topics, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46679?
CVE-2026-46679 is a high-severity denial of service vulnerability in js-libp2p, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
Which versions are affected by CVE-2026-46679?
2 open source packages ship an affected version, including @libp2p/gossipsub.
| Package | Affected | Fixed in |
|---|---|---|
@libp2p/gossipsub npm | All versions | 15.0.23 |
@libp2p/gossipsub npm | All versions | 15.0.23 |
How do I fix CVE-2026-46679?
Upgrade @libp2p/gossipsub to 15.0.23 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46679 exists.
Sources
Also known as GHSA-4f8r-922h-2vgv.