CVE-2026-46679: libp2p: Memory DoS via subscription flood of unique topics

Synopsis

A memory exhaustion vulnerability (Denial of Service via subscription flood) affects the JavaScript implementation of the libp2p networking stack, specifically the @libp2p/gossipsub component in js-libp2p versions prior to 15.0.23. The flaw is reachable over the network without any authentication, and three cooperating omissions in gossipsub's subscription handling allow a single unauthenticated peer to exhaust the Node.js heap of the target node. Successful exploitation crashes the affected gossipsub node, causing a complete loss of availability. A patched-image rebuild at version 15.0.23 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target gossipsub node over the network; the service must be reachable from an external or peer-connected position.

• AuthenticationNot required

  No credentials or account are needed; the attack can be launched by any unauthenticated peer that can establish a connection.

• Victim interactionNot required

  No user or operator action is required; the attacker triggers heap exhaustion entirely through network-level peer messaging.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond network access.

Blast Radius

• Crashes the Node.js process hosting the gossipsub node, taking down all peer-to-peer networking functions it provides.
• A single attacking peer is sufficient to exhaust available heap memory, so no botnet or coordinated source is needed.
• Recovery requires a process restart, creating a repeatable availability outage if the attacker remains reachable.
• No confidential data is read and no stored data is modified; impact is limited to service availability.