1vulnerability
- Critical0 (0.0%)
- High1 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
libp2p-peer-store
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting libp2p-peer-store, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-vrf4-mx87-p53w | High | libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses### Summary `@libp2p/peer-store` accepts a signed `PeerRecord` whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable `consumePeerRecord` path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped `PeerRecord.peerId`. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim. ### Details The vulnerable code is in `packages/peer-store/src/index.ts`: - `Reco |
| GitHub (opens in a new tab) |
- GHSA-vrf4-mx87-p53wHighlibp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
>= 8.0.0, < 12.0.24
### Summary `@libp2p/peer-store` accepts a signed `PeerRecord` whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable `consumePeerRecord` path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped `PeerRecord.peerId`. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim. ### Details The vulnerable code is in `packages/peer-store/src/index.ts`: - `Reco
CVE: CVE-2026-86039