# Libp2p vulnerabilities Source: https://junglewise.ai/threats/vendors/libp2p Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/libp2p.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 12 vulnerabilities in Libp2p: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95859, was published on 16 October 2026. 2 vulnerabilities in the last four weeks, down 33% on the four before (3). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 6 - All time: 12 (0 critical, 0 exploited in the wild) ## About Libp2p libp2p is a modular peer-to-peer networking library. ## Latest Libp2p vulnerabilities - [CVE-2026-95859: libp2p-rust Gossipsub GRAFT memory exhaustion DoS](https://junglewise.ai/threats/cve-2026-95859-libp2p-rust-is-the-official-rust-language-implementation-of-the) (info, published 16 Oct 2026) - [CVE-2026-103936: libp2p WebRTC denial of service in STUN handling](https://junglewise.ai/threats/cve-2026-103936-libp2p-is-a-javascript-implementation-of-the-libp2p-networking) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-86040: libp2p floodsub unauthenticated RPC denial of service](https://junglewise.ai/threats/cve-2026-86040-libp2p-floodsub-unauthenticated-rpc-denial-of-service) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-86039: libp2p PeerStore peer ID spoofing in signed records](https://junglewise.ai/threats/cve-2026-86039-libp2p-peerstore-peer-id-spoofing-in-signed-records) (high, CVSS 8.2, published 17 Sep 2026) - [CVE-2026-86038: libp2p Gossipsub message authentication bypass in RSA peer IDs](https://junglewise.ai/threats/cve-2026-86038-libp2p-gossipsub-message-authentication-bypass-in-rsa-peer-ids) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-77384: libp2p circuit-relay-v2 denial of service via listener leak on reservation refresh](https://junglewise.ai/threats/cve-2026-77384-libp2p-circuit-relay-v2-denial-of-service-via-listener-leak-on) (high, CVSS 7.5, published 24 Aug 2026) - [CVE-2026-49866: libp2p gossipsub denial of service via oversized control messages](https://junglewise.ai/threats/cve-2026-49866-libp2p-gossipsub-denial-of-service-via-oversized-control-messages) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-46679: libp2p js-libp2p memory exhaustion in @libp2p/gossipsub](https://junglewise.ai/threats/cve-2026-46679-libp2p-js-libp2p-memory-exhaustion-in-libp2p-gossipsub) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-45783: libp2p @libp2p/kad-dht Disk Exhaustion via Unvalidated PUT_VALUE Records](https://junglewise.ai/threats/cve-2026-45783-libp2p-libp2p-kad-dht-disk-exhaustion-via-unvalidated-put-value) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-34219: libp2p rust-libp2p denial of service in Gossipsub heartbeat](https://junglewise.ai/threats/cve-2026-34219-libp2p-rust-libp2p-denial-of-service-in-gossipsub-heartbeat) (medium, CVSS 5.9, published 31 Mar 2026) - [CVE-2023-39533: libp2p go-libp2p resource exhaustion via large RSA keys](https://junglewise.ai/threats/cve-2023-39533-libp2p-go-libp2p-resource-exhaustion-via-large-rsa-keys) (high, CVSS 7.5, published 9 Aug 2023) - [CVE-2022-23487: js-libp2p denial-of-service via resource exhaustion](https://junglewise.ai/threats/cve-2022-23487-js-libp2p-denial-of-service-via-resource-exhaustion) (low, CVSS 3.1, published 7 Dec 2022) ## Most severe Libp2p vulnerabilities - [CVE-2026-86039: libp2p PeerStore peer ID spoofing in signed records](https://junglewise.ai/threats/cve-2026-86039-libp2p-peerstore-peer-id-spoofing-in-signed-records) (high, CVSS 8.2, published 17 Sep 2026) - [CVE-2023-39533: libp2p go-libp2p resource exhaustion via large RSA keys](https://junglewise.ai/threats/cve-2023-39533-libp2p-go-libp2p-resource-exhaustion-via-large-rsa-keys) (high, CVSS 7.5, published 9 Aug 2023) - [CVE-2026-86040: libp2p floodsub unauthenticated RPC denial of service](https://junglewise.ai/threats/cve-2026-86040-libp2p-floodsub-unauthenticated-rpc-denial-of-service) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-49866: libp2p gossipsub denial of service via oversized control messages](https://junglewise.ai/threats/cve-2026-49866-libp2p-gossipsub-denial-of-service-via-oversized-control-messages) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-77384: libp2p circuit-relay-v2 denial of service via listener leak on reservation refresh](https://junglewise.ai/threats/cve-2026-77384-libp2p-circuit-relay-v2-denial-of-service-via-listener-leak-on) (high, CVSS 7.5, published 24 Aug 2026) - [CVE-2026-103936: libp2p WebRTC denial of service in STUN handling](https://junglewise.ai/threats/cve-2026-103936-libp2p-is-a-javascript-implementation-of-the-libp2p-networking) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-45783: libp2p @libp2p/kad-dht Disk Exhaustion via Unvalidated PUT_VALUE Records](https://junglewise.ai/threats/cve-2026-45783-libp2p-libp2p-kad-dht-disk-exhaustion-via-unvalidated-put-value) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-46679: libp2p js-libp2p memory exhaustion in @libp2p/gossipsub](https://junglewise.ai/threats/cve-2026-46679-libp2p-js-libp2p-memory-exhaustion-in-libp2p-gossipsub) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-86038: libp2p Gossipsub message authentication bypass in RSA peer IDs](https://junglewise.ai/threats/cve-2026-86038-libp2p-gossipsub-message-authentication-bypass-in-rsa-peer-ids) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-34219: libp2p rust-libp2p denial of service in Gossipsub heartbeat](https://junglewise.ai/threats/cve-2026-34219-libp2p-rust-libp2p-denial-of-service-in-gossipsub-heartbeat) (medium, CVSS 5.9, published 31 Mar 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 33% on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Libp2p technologies - [Libp2p Gossipsub](https://junglewise.ai/threats/technologies/gossipsub): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Libp2p vulnerabilities", https://junglewise.ai/threats/vendors/libp2p, 9 November 2026.