Security Flaw in libp2p Gossipsub Affecting JavaScript Networking

CVE-2026-86038

What is CVE-2026-86038?

The libp2p Gossipsub implementation has a vulnerability in its message signature validation process. Specifically, from versions 15.0.0 to 16.0.5, an attacker can exploit improperly bound RSA peer IDs. By signing a message with a malicious private key and providing a crafted public key, the attacker can forge messages that appear to originate from a trusted RSA peer. This flaw compromises message integrity by allowing false attribution of the message's source, potentially leading to unauthorized data processing in applications that rely on accurate validation, authorization, or audit logging. The issue has been resolved in version 16.0.5.

References