# CVE-2026-86039: libp2p PeerStore peer ID spoofing in signed records

Source: https://junglewise.ai/threats/cve-2026-86039-libp2p-peerstore-peer-id-spoofing-in-signed-records  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-86039 · Severity: high · CVSS 8.2 · Published 2026-09-17

libp2p's peer discovery system accepts fraudulently signed peer records that claim to represent one peer but are actually signed by an attacker. This allows attackers to inject malicious network addresses into the address book for legitimate peers, causing applications to attempt to connect to attacker-controlled endpoints instead of the real peer. While this doesn't allow an attacker to impersonate a victim in an encrypted connection, it can disrupt network communications and poison peer routing tables.

Vendors: [Libp2p](https://junglewise.ai/threats/vendors/libp2p), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-86039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86039 being exploited in the wild.

**How severe is CVE-2026-86039?** High severity, with a CVSS score of 8.2, published 17 September 2026.

**Which products and versions are affected?** @libp2p/peer-store (npm) >= 8.0.0, < 12.0.24, SEMVER:introduced=8.0.0,fixed=12.0.24.

**Is there a fix for CVE-2026-86039?** Yes. @libp2p/peer-store (npm): upgrade to 12.0.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86039 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86039?** Check whether you run Libp2p Peer-Store or @libp2p/peer-store (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @libp2p/peer-store (npm): upgrade to 12.0.24 or later

  ```sh
  npm install @libp2p/peer-store@12.0.24
  ```


## Technical details

The vulnerability is a signature verification bypass in `@libp2p/peer-store`'s `consumePeerRecord` function. The code verifies that a `PeerRecord` envelope is cryptographically signed, but fails to verify that the signer's peer ID matches the peer ID claimed in the record payload. An attacker can sign an envelope with their own key while embedding a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses under the victim's identity. The gossipsub Peer Exchange path is reachable because it derives the expected peer from untrusted wire data (`pi.peerID`), allowing an attacker to set it to their own ID while placing the victim ID inside. The missing invariant check is: `peerRecord.peerId.equals(peerIdFromCID(envelope.publicKey.toCID()))`. The attack requires network access to send malicious peer records but no authentication or user interaction.

## Affected products

- libp2p peer-store

## Identifiers

- CVE-2026-86039
- GHSA-vrf4-mx87-p53w

## Timeline

- 2026-09-17: disclosed
- other: CVE-2026-86039 assigned