Executive brief
libp2p's Gossipsub is a messaging protocol used in distributed P2P networks to propagate data across peers. A flaw in StrictSign validation allows an attacker to forge messages that appear to come from any victim using an RSA peer ID, undermining message origin verification. Applications relying on message source attribution for access control, moderation, or audit logging can be deceived into trusting attacker-controlled content as legitimate.
Technical details
The vulnerability exists in the `validateToRawMessage` function in `packages/gossipsub/src/utils/buildRawMessage.ts`. When validating signed messages with StrictSign policy, the code checks that a supplied message public key matches the peer ID's public key—but this check is skipped for RSA peer IDs, which do not inline their public key in the peer ID representation. An attacker can set the `from` field to a victim's RSA peer ID, sign the message with their own private key, include their own public key in `msg.key`, and the signature will validate despite the forged origin. The missing invariant is `peerIdFromPublicKey(publicKey).equals(fromPeerId)`. This is a message authentication bypass under the default StrictSign signature policy affecting gossipsub v15.0.0 and later. A patch is required to enforce key-to-peer-ID binding for all peer ID types.
Affected products
- libp2p Gossipsub 15.0.0 and later
Timeline
- 2026-09-17: disclosed