# CVE-2026-86040: libp2p floodsub unauthenticated RPC denial of service

Source: https://junglewise.ai/threats/cve-2026-86040-libp2p-floodsub-unauthenticated-rpc-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86040 · Severity: high · CVSS 7.5 · Published 2026-09-17

libp2p is a peer-to-peer networking library used by many decentralized applications. The floodsub protocol component accepts unauthenticated messages without proper limits, allowing a remote attacker to send specially crafted network frames that consume all CPU and memory resources, causing the application to freeze or crash and disrupting service availability.

Vendors: [Libp2p](https://junglewise.ai/threats/vendors/libp2p).

## Quick answers

**Is CVE-2026-86040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86040 being exploited in the wild.

**How severe is CVE-2026-86040?** High severity, with a CVSS score of 7.5, published 17 September 2026.

**Which products and versions are affected?** Libp2p Js-Libp2p before 11.0.26.

**Is there a fix for CVE-2026-86040?** A patch was published on 2026-07-17: Fix merged in commit fb9e8a7; version 11.0.26 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86040 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86040?** Check whether you run Libp2p Js-Libp2p at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service flaw in the floodsub RPC message handler (packages/floodsub/src/peer-streams.ts and floodsub.ts). The root cause is twofold: (1) missing per-frame element count limits on protobuf decoding—a single bounded-size network frame can expand into millions of subscription entries during decoding; (2) synchronous, unbounded processing of subscription arrays without throttling. An unauthenticated remote peer can send RPC frames with excessive subscriptions to the /floodsub/1.0.0 stream, causing event loop blocking (CPU exhaustion) and unremoved PeerSet allocations (memory exhaustion) leading to out-of-memory termination and node unavailability. The subscription path bypasses message signature validation and the message-processing queue. The fix (version 11.0.26) applies configurable decode limits (default 5000 subscriptions and 5000 messages per frame) and cleans up empty topic entries on peer removal.

## Affected products

- libp2p js-libp2p before 11.0.26

## Timeline

- 2026-09-17: disclosed
- 2026-07-17: patched: Fix merged in commit fb9e8a7; version 11.0.26 released

## References

- [https://github.com/libp2p/js-libp2p/commit/fb9e8a76e9ac75924928fae4ce11d00f68320a83](https://github.com/libp2p/js-libp2p/commit/fb9e8a76e9ac75924928fae4ce11d00f68320a83)
- [https://github.com/libp2p/js-libp2p/pull/3568](https://github.com/libp2p/js-libp2p/pull/3568)

## Related threats

- [js-libp2p denial-of-service via resource exhaustion](https://junglewise.ai/threats/cve-2022-23487-js-libp2p-denial-of-service-via-resource-exhaustion)