Executive brief
libp2p is a peer-to-peer networking library used by many decentralized applications. The floodsub protocol component accepts unauthenticated messages without proper limits, allowing a remote attacker to send specially crafted network frames that consume all CPU and memory resources, causing the application to freeze or crash and disrupting service availability.
Technical details
The vulnerability is a denial-of-service flaw in the floodsub RPC message handler (packages/floodsub/src/peer-streams.ts and floodsub.ts). The root cause is twofold: (1) missing per-frame element count limits on protobuf decoding—a single bounded-size network frame can expand into millions of subscription entries during decoding; (2) synchronous, unbounded processing of subscription arrays without throttling. An unauthenticated remote peer can send RPC frames with excessive subscriptions to the /floodsub/1.0.0 stream, causing event loop blocking (CPU exhaustion) and unremoved PeerSet allocations (memory exhaustion) leading to out-of-memory termination and node unavailability. The subscription path bypasses message signature validation and the message-processing queue. The fix (version 11.0.26) applies configurable decode limits (default 5000 subscriptions and 5000 messages per frame) and cleans up empty topic entries on peer removal.
Affected products
- libp2p js-libp2p before 11.0.26
Timeline
- 2026-09-17: disclosed
- 2026-07-17: patched: Fix merged in commit fb9e8a7; version 11.0.26 released