npm/@libp2p/gossipsub CVE-2026-49866: high 7.5, EPSS 0.63%

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

Action: Upgrade @libp2p/gossipsub to 16.0.0 or later.

npm i @libp2p/gossipsub@16.0.0

Affected

Fixed versions

Sources

• osv: GHSA-cwc9-cp4j-mcvv
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv
• https://nvd.nist.gov/vuln/detail/CVE-2026-49866
• https://github.com/libp2p/js-libp2p/pull/3520
• https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899
• https://github.com/libp2p/js-libp2p
• https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0

CVE-2026-49866 · published 2026-07-10T16:04:49Z · modified 2026-07-10T16:15:10.853144805Z · JSON