CVE-2022-24759

`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Users should upgrade to version 4.1.2 or 5.0.3 to receive a patch. There are currently no known workarounds.

• CWE-347

• https://github.com/ChainSafe/js-libp2p-noise/pull/130Patch, Third Party Advisory
• https://github.com/ChainSafe/js-libp2p-noise/releases/tag/v5.0.3Patch, Third Party Advisory
• https://github.com/ChainSafe/js-libp2p-noise/security/advisories/GHSA-j3ff-xp6c-6gccThird Party Advisory
• https://github.com/ChainSafe/js-libp2p-noise/pull/130Patch, Third Party Advisory
• https://github.com/ChainSafe/js-libp2p-noise/releases/tag/v5.0.3Patch, Third Party Advisory
• https://github.com/ChainSafe/js-libp2p-noise/security/advisories/GHSA-j3ff-xp6c-6gccThird Party Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24753Stripe CLI is a command-line tool for the Stripe eCommerce p…7
• CVE-2022-24754PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-24755Bareos is open source software for backup, archiving, and re…9.8
• CVE-2022-24756Bareos is open source software for backup, archiving, and re…7.5
• CVE-2022-24757The Jupyter Server provides the backend (i.e. the core servi…7.5
• CVE-2022-24758The Jupyter notebook is a web-based notebook environment for…7.5
• CVE-2022-2476A null pointer dereference bug was found in wavpack-5.4.0 Th…5.5
• CVE-2022-24760Parse Server is an open source http web server backend. In v…10
• CVE-2022-24761Waitress is a Web Server Gateway Interface server for Python…7.5
• CVE-2022-24762sysend.js is a library that allows a user to send messages b…6.5
• CVE-2022-24763PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24764PJSIP is a free and open source multimedia communication lib…7.5