CVE-2026-46679
Last modified
CVE-2026-46679 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-46679?
How severe is CVE-2026-46679?
How do I fix CVE-2026-46679?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-4667HP System Optimizer might potentially be vulnerable to escal…7.3
- CVE-2026-46670YesWiki is a wiki system written in PHP. Prior to version 4.…9.8
- CVE-2026-46671Rust OneNote File Parser is a parser for Microsoft OneNote f…4.4
- CVE-2026-46672Actual is a local-first personal finance app. Prior to 26.6.…4.6
- CVE-2026-46673Russh is a Rust SSH client & server library. Prior to versio…7.5
- CVE-2026-46678Pydantic AI is a Python agent framework for building Generat…5.9
- CVE-2026-4668The Booking for Appointments and Events Calendar - Amelia pl…6.5
- CVE-2026-46680containerd is an open-source container runtime. In versions …7.8
- CVE-2026-46681@nevware21/ts-utils is a comprehensive TypeScript/JavaScript…7.2
- CVE-2026-46682BigBlueButton is an open-source virtual classroom. Prior to …8.5
- CVE-2026-46683Snappy is a PHP library allowing thumbnail, snapshot or PDF …6.9
- CVE-2026-46684DataEase is an open source data visualization and analysis t…9.5
Are you affected by CVE-2026-46679?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST