CVE-2026-49866: libp2p Gossipsub Event Loop DoS – Patch to 16.0.0

Technical summary

The @libp2p/gossipsub module before version 16.0.0 configures defaultDecodeRpcLimits with maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity, removing practical constraints on control message array sizes. During RPC decoding in message/decodeRpc.ts and gossipsub.ts, the synchronous iteration over these unbounded arrays—potentially spanning ~180,000 message IDs per 4 MB frame—causes event loop blocking. This CWE-770 Resource Exhaustion condition leaves the Node.js process unresponsive to legitimate traffic and application logic.

Business impact

Peer-to-peer applications and mesh networks relying on libp2p gossipsub become unavailable when under attack. Services lose connectivity, fail to propagate messages, and cannot serve users. For platforms using gossipsub for consensus, coordination, or content distribution, a single attacker can cause widespread disruption without requiring privileged network access. Recovery requires manual intervention or timeout-based failover.

Affected systems

JavaScript/TypeScript applications using @libp2p/gossipsub versions prior to 16.0.0 are vulnerable. This includes peer-to-peer platforms, decentralized networks, distributed applications, and mesh networking overlays built on libp2p. The vulnerability affects any deployment where libp2p gossipsub is exposed to untrusted network peers.

Exploitability

Exploitability is straightforward for a network-adjacent attacker. No authentication, user interaction, or local access is required. An attacker merely constructs a gossipsub control message with oversized IHAVE or IWANT arrays and sends it to a vulnerable peer. The synchronous processing guarantees event loop starvation. The barrier to exploitation is low: knowledge of the gossipsub protocol and ability to reach the target peer on the network suffice.

Remediation

Upgrade @libp2p/gossipsub to version 16.0.0 or later. This release implements bounded limits on maxIhaveMessageIDs and maxIwantMessageIDs, ensuring that control message arrays are validated and truncated before synchronous iteration. Verify the upgrade across all application dependencies and peer nodes to maintain network consistency.

Patch guidance

Apply @libp2p/gossipsub version 16.0.0 as an urgent update. Review your package.json and lock files to confirm the installed version. If using a monorepo or pinned transitive dependency, ensure all consuming packages declare the correct version. Test the upgrade in a staging environment that simulates network load before rolling out to production. No configuration changes are required; the fix is automatic upon upgrade.

Detection guidance

Monitor Node.js process CPU and event loop latency metrics. Sudden spikes in synchronous CPU time or event loop lag correlated with incoming gossipsub traffic suggest potential attack. Log gossipsub RPC message sizes and array counts; oversized control messages should be flagged. Network intrusion detection can identify gossipsub frames exceeding typical size distributions. Consider ingesting libp2p debug logs to correlate message decode times with availability anomalies.

Why prioritize this

This vulnerability merits immediate action because it enables trivial network-based denial of service against a foundational mesh networking library. The low attack complexity, lack of authentication requirements, and high availability impact justify rapid remediation. Any organization operating public or semi-public peer-to-peer infrastructure should treat this as critical.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects an unauthenticated network attack with low complexity that causes total availability loss to affected services. Confidentiality and integrity remain unaffected—the attacker cannot steal data or corrupt state, only starve the event loop. The score aligns with the denial-of-service nature and the broad network-reachable attack surface.

Frequently asked questions