CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

• CWE-290
• CWE-345

• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85999Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86000Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86003CoreDNS is a DNS server written in Go. Prior to 1.14.7, the …7.5
• CVE-2026-8602In ScadaBR version 1.2.0, a Missing Authentication for Criti…9.1
• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8
• CVE-2026-86038libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow a…8.8
• CVE-2026-86040libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8