Executive brief
js-libp2p is a peer-to-peer networking library used in blockchain and distributed applications to establish and manage network connections. Versions before 0.38.0 lack proper resource limits and can be overwhelmed by a targeted attack that allocates excessive memory, causing the application to crash and disrupting service availability.
Technical details
This is a resource exhaustion vulnerability (CWE-400, CWE-770) in js-libp2p's connection, stream, peer, and memory management. The root cause is inadequate resource limits in the connection manager, which was designed to handle normal peer churn but not deliberate DoS attacks. An attacker with network access can send crafted requests that force the allocation of large amounts of memory, ultimately leading to out-of-memory conditions and process termination. The attack requires no authentication or user interaction. The vulnerability is fixed in js-libp2p v0.38.0 and later, which implements tighter resource scoping and limits.
Affected products
- libp2p js-libp2p < 0.38.0
Timeline
- 2022-12-07: disclosed