CVE-2022-23487

js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of js-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to update their js-libp2p dependency to `v0.38.0` or greater. There are no known workarounds for this vulnerability.

• CWE-400
• CWE-770

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwvMitigation, Third Party Advisory
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwvMitigation, Third Party Advisory

Published

Dec 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23481xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23482xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23483xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23484xrdp is an open source project which provides a graphical lo…9.8
• CVE-2022-23485Sentry is an error tracking and performance monitoring platf…3.7
• CVE-2022-23486libp2p-rust is the official rust language Implementation of …7.5
• CVE-2022-23488BigBlueButton is an open source web conferencing system. Ver…7.5
• CVE-2022-2349Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-23490BigBlueButton is an open source web conferencing system. Ver…4.3
• CVE-2022-23491Certifi is a curated collection of Root Certificates for val…7.5
• CVE-2022-23492go-libp2p is the offical libp2p implementation in the Go pro…7.5
• CVE-2022-23493xrdp is an open source project which provides a graphical lo…9.1