{"action":"Upgrade @libp2p/gossipsub to 16.0.0 or later.","affected":[{"fixed":"16.0.0","introduced":"0"}],"component":"@libp2p/gossipsub","cve_ids":["CVE-2026-49866"],"ecosystem":"npm","epss":0.0063,"exploited":false,"fixed_versions":["16.0.0"],"ghsa_id":"GHSA-cwc9-cp4j-mcvv","id":"tcs_01M5KFKSA17F3J81AHMVYNKVCY","modified_at":"2026-07-10T16:15:10.853144805Z","published_at":"2026-07-10T16:04:49Z","references":["https://osv.dev/vulnerability/GHSA-cwc9-cp4j-mcvv","https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv","https://nvd.nist.gov/vuln/detail/CVE-2026-49866","https://github.com/libp2p/js-libp2p/pull/3520","https://github.com/libp2p/js-libp2p/commit/773dd80ded24dbd6b19e675c89fd2f3b45f2d899","https://github.com/libp2p/js-libp2p","https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cwc9-cp4j-mcvv","url":"https://osv.dev/vulnerability/GHSA-cwc9-cp4j-mcvv"}],"summary":"libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays"}