CVE-2026-86038

npm/@libp2p/gossipsub CVE-2026-86038: high 7.5, EPSS 0.19%

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Action: Upgrade @libp2p/gossipsub to 16.0.5 or later.

npm i @libp2p/gossipsub@16.0.5

Affected

Fixed versions

Sources

• osv: GHSA-c3gv-825q-fvmp
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp
• https://github.com/libp2p/js-libp2p/pull/3569
• https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f
• https://github.com/libp2p/js-libp2p
• https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5

CVE-2026-86038 · published 2026-09-17T17:29:31Z · modified 2026-09-17T17:45:04.131264619Z · JSON