{"action":"Upgrade @libp2p/gossipsub to 15.0.23 or later.","affected":[{"fixed":"15.0.23","introduced":"0"}],"component":"@libp2p/gossipsub","cve_ids":["CVE-2026-46679"],"ecosystem":"npm","epss":0.00278,"exploited":false,"fixed_versions":["15.0.23"],"ghsa_id":"GHSA-4f8r-922h-2vgv","id":"tcs_01M5KF05Z40WKYQCVCH1R7GBGG","modified_at":"2026-09-10T03:50:45.401596700Z","published_at":"2026-05-21T21:38:40Z","references":["https://osv.dev/vulnerability/GHSA-4f8r-922h-2vgv","https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv","https://nvd.nist.gov/vuln/detail/CVE-2026-46679","https://github.com/libp2p/js-libp2p"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-4f8r-922h-2vgv","url":"https://osv.dev/vulnerability/GHSA-4f8r-922h-2vgv"}],"summary":"js-libp2p: Memory DoS via subscription flood of unique topics"}