{"action":"Upgrade @libp2p/gossipsub to 16.0.5 or later.","affected":[{"fixed":"16.0.5","introduced":"15.0.0"}],"component":"@libp2p/gossipsub","cve_ids":["CVE-2026-86038"],"ecosystem":"npm","epss":0.00193,"exploited":false,"fixed_versions":["16.0.5"],"ghsa_id":"GHSA-c3gv-825q-fvmp","id":"tcs_01M5KFHJSXQMEQKGPDS61DFQA1","modified_at":"2026-09-17T17:45:04.131264619Z","published_at":"2026-09-17T17:29:31Z","references":["https://osv.dev/vulnerability/GHSA-c3gv-825q-fvmp","https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp","https://github.com/libp2p/js-libp2p/pull/3569","https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f","https://github.com/libp2p/js-libp2p","https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-c3gv-825q-fvmp","url":"https://osv.dev/vulnerability/GHSA-c3gv-825q-fvmp"}],"summary":"libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID"}