Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@libp2p/peer-store

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmAmendedPublished

    libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

    CVE-2026-86039 · GHSA-vrf4-mx87-p53w

    Affected
    • npm @libp2p/peer-store >= 8.0.0, < 12.0.24
    Fixed in
    12.0.24· Vendor fix available
    Issue
    @libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped PeerRecord.peerId. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim. Details The vulnerable code is in packages/peer-store/src/index.ts: - RecordEnvelope.openAndCertify(buf, PeerRecord.DOMAIN, options) verifies the envelope signature. - const peerId = peerIdFromCID(envelope.publicKey.toCID()) derives the envelope signer peer ID. - The optional expectedPeer check only compares expectedPeer to the envelope signer. - const peerRecord = PeerRecord.createFromProtobuf(envelope.payload) decodes peerRecord.peerId from attacker-controlled signed payload bytes. -…

    Recommended action: Upgrade to 12.0.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →