Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-86038, describes an issue in @libp2p/gossipsub where the StrictSign validation policy fails to properly bind a supplied message public key (msg.key) to the claimed from peer ID when the from peer ID is an RSA-style peer ID. This allows an attacker to forge messages attributed to a victim RSA peer ID. The vulnerability description explicitly points to packages/gossipsub/src/utils/buildRawMessage.ts and the validateToRawMessage function as containing the vulnerable code.
Analysis of the provided commit cec2b1f349d130065e561349a0336a239528267f confirms this. The patch modifies the validateToRawMessage function in packages/gossipsub/src/utils/buildRawMessage.ts. Specifically, within the block where msg.key is present, the original conditional check if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) was replaced with if (!fromPeerId.equals(publicKey.toMultihash().bytes)). The original check was flawed because fromPeerId.publicKey is undefined for RSA peer IDs, causing the validation to be bypassed. The new check correctly derives the peer ID from the provided public key and compares it to the from peer ID, ensuring proper authentication for all peer ID types. Therefore, validateToRawMessage is the function that contained the vulnerability and would be present in a runtime profile during exploitation.
validateToRawMessagepackages/gossipsub/src/utils/buildRawMessage.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @libp2p/gossipsub | npm | >= 15.0.0, < 16.0.5 | 16.0.5 |