js-libp2p: Memory DoS via subscription flood of unique topics

Description

Three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options.

1. defaultDecodeRpcLimits.maxSubscriptions = Infinity (packages/gossipsub/src/message/decodeRpc.ts:11): no decode-level cap on subscription entries per RPC. 2.

Recommendation

Update the @libp2p/gossipsub package to the latest compatible version. Followings are version details:

• Affected version(s): <= 15.0.22
• Patched version(s): 15.0.23

References

• GHSA-4f8r-922h-2vgv
• CVE-2026-46679
• CWE-20
• CWE-400
• CWE-401
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS - CVE-2026-2581
• i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header - CVE-2026-41683
• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
• node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit - CVE-2022-25231

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@libp2p/gossipsub