Signature Verification Flaw in libp2p Peer Store Affects Multiple Versions

CVE-2026-86039

What is CVE-2026-86039?

A vulnerability exists in the libp2p peer store implementation where signature verification does not properly validate peer IDs against expected values. Specifically, from versions 8.0.0 to 12.0.24, an attacker can exploit this flaw by signing a record using their own key and embedding a victim's peer ID in the payload. This situation could lead to address-book corruption and manipulation of routing paths, causing significant disruption in peer connectivity and communication. While the appropriate remote peer identity verification still exists to mitigate identity takeover risks, affected users should update to version 12.0.24 or later to eliminate this security risk.

References