cve.bz

CVE-2026-46679

7.5 highEPSS 0.3%

High (7.5). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in @libp2p/gossipsub 15.0.23.

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWEs
CWE-20, CWE-400, CWE-401
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4f8r-922h-2vgvnpm@libp2p/gossipsub<15.0.2315.0.23

References

Check your stackJSON