CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.

• CWE-290
• CWE-345

• https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30
• https://github.com/libp2p/js-libp2p/pull/3570
• https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8602In ScadaBR version 1.2.0, a Missing Authentication for Criti…9.1
• CVE-2026-86020Part-DB is an open source inventory management system for el…4.6
• CVE-2026-86022VNote is a note-taking platform. Prior to 4.3.0, SessionConf…7
• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8
• CVE-2026-86035Weblate is a web-based continuous localization platform used…8.5
• CVE-2026-86038libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow a…8.8
• CVE-2026-86040libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86041ezBookkeeping is an open source, self-hosted personal financ…5.3
• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-86047MariaDB server is a community developed fork of MySQL server…7.7
• CVE-2026-86049Jupyter Server is the backend for Jupyter web applications. …7.1