7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46679

CVE-2026-46679: libp2p: Memory DoS via subscription flood of unique topics

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46679

CVE-2026-46679:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@libp2p/gossipsub	npm	<= 15.0.22	15.0.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security advisory and the corresponding patch has identified three key functions in @libp2p/gossipsub that contribute to a memory exhaustion vulnerability. The handleReceivedSubscription function allows for unbounded growth of the this.topics map, while the removePeer function fails to clean up this map, leading to a memory leak. The stop function also contributes to the memory leak by not clearing the this.topics map. The patch addresses these issues by adding the necessary cleanup logic to these functions. The identified vulnerable functions are the exact locations where the memory is allocated and leaked, and they would be the primary indicators of this vulnerability being exploited in a runtime profile.

Vulnerable functions

GossipSub.handleReceivedSubscription

packages/gossipsub/src/index.ts

The `handleReceivedSubscription` function is vulnerable because it allows an attacker to add an unbounded number of unique topics to the `this.topics` map. The patch introduces a check to delete the topic from the map if the last peer unsubscribes, thus preventing the map from growing indefinitely.

GossipSub.removePeer

packages/gossipsub/src/index.ts

The `removePeer` function is vulnerable because it fails to remove empty sets from `this.topics` after a peer disconnects, leading to a memory leak. The patch ensures that if a peer's disconnection results in a topic having no subscribers, the topic is removed from the `this.topics` map.

GossipSub.stop

packages/gossipsub/src/index.ts

The `stop` function is vulnerable because it does not clear the `this.topics` map when the gossipsub service is stopped, causing memory to be leaked for the lifetime of the process. The patch adds `this.topics.clear()` to ensure that all memory associated with topics is released when the service is stopped.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.