Is CVE-2026-86040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86040 being exploited in the wild.

How severe is CVE-2026-86040?

High severity, with a CVSS score of 7.5, published 17 September 2026.

Which products and versions are affected?

Libp2p Js-Libp2p before 11.0.26.

Is there a fix for CVE-2026-86040?

A patch was published on 2026-07-17: Fix merged in commit fb9e8a7; version 11.0.26 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86040 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86040?

Check whether you run Libp2p Js-Libp2p at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86040: libp2p floodsub unauthenticated RPC denial of service

CVE-2026-86040 · Severity: high · CVSS 7.5 · Published 2026-09-17

libp2p is a peer-to-peer networking library used by many decentralized applications. The floodsub protocol component accepts unauthenticated messages without proper limits, allowing a remote attacker to send specially crafted network frames that consume all CPU and memory resources, causing the application to freeze or crash and disrupting service availability.

Vendors: Libp2p.

Quick answers

Is CVE-2026-86040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86040 being exploited in the wild.
How severe is CVE-2026-86040?: High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?: Libp2p Js-Libp2p before 11.0.26.
Is there a fix for CVE-2026-86040?: A patch was published on 2026-07-17: Fix merged in commit fb9e8a7; version 11.0.26 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86040 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86040?: Check whether you run Libp2p Js-Libp2p at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service flaw in the floodsub RPC message handler (packages/floodsub/src/peer-streams.ts and floodsub.ts). The root cause is twofold: (1) missing per-frame element count limits on protobuf decoding—a single bounded-size network frame can expand into millions of subscription entries during decoding; (2) synchronous, unbounded processing of subscription arrays without throttling. An unauthenticated remote peer can send RPC frames with excessive subscriptions to the /floodsub/1.0.0 stream, causing event loop blocking (CPU exhaustion) and unremoved PeerSet allocations (memory exhaustion) leading to out-of-memory termination and node unavailability. The subscription path bypasses message signature validation and the message-processing queue. The fix (version 11.0.26) applies configurable decode limits (default 5000 subscriptions and 5000 messages per frame) and cleans up empty topic entries on peer removal.

Affected products

libp2p js-libp2p before 11.0.26

Timeline

2026-09-17: disclosed
2026-07-17: patched: Fix merged in commit fb9e8a7; version 11.0.26 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.