CVE-2026-86039

npm/@libp2p/peer-store CVE-2026-86039: high 8.2, EPSS 0.27%

libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

Action: Upgrade @libp2p/peer-store to 12.0.24 or later.

npm i @libp2p/peer-store@12.0.24

Affected

Fixed versions

Sources

• osv: GHSA-vrf4-mx87-p53w
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24

CVE-2026-86039 · published 2026-09-17T18:01:38Z · modified 2026-09-17T18:15:04.074028119Z · JSON