CVE-2026-49866: libp2p Gossipsub DoS Vulnerability

CVE-2026-49866 Overview

CVE-2026-49866 is a denial-of-service vulnerability in @libp2p/gossipsub, the JavaScript implementation of the gossipsub pub/sub protocol used within the libp2p networking stack. The defaultDecodeRpcLimits configuration set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing remote peers to send oversized IHAVE and IWANT control message arrays. The decoder in message/decodeRpc.ts and gossipsub.ts then synchronously iterates roughly 180,000 message IDs per 4 MB frame, blocking the Node.js event loop. The issue affects versions prior to 16.0.0 and is fixed in gossipsub-v16.0.0. This weakness is classified under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Remote unauthenticated peers can stall the Node.js event loop of any gossipsub-enabled libp2p node by sending a single oversized RPC frame, disrupting availability of the entire peer-to-peer service.

Affected Products

@libp2p/gossipsub versions prior to 16.0.0
js-libp2p nodes embedding vulnerable gossipsub releases
Node.js applications relying on libp2p gossipsub for pub/sub messaging

Discovery Timeline

2026-07-08 - CVE-2026-49866 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49866

Vulnerability Analysis

Gossipsub uses IHAVE and IWANT control messages to advertise and request message IDs between peers. The decoder validates RPC payloads against a set of limits declared in defaultDecodeRpcLimits. In releases prior to 16.0.0, every relevant limit was set to Infinity, so any peer could include arbitrarily large arrays of message IDs inside a single RPC frame.

When the decoder receives such a frame, it iterates each message ID synchronously on the main thread. A 4 MB frame packs approximately 180,000 message IDs, and processing them blocks the Node.js event loop. During that time, the node cannot service other peers, respond to network I/O, or run timers, resulting in a denial of service across the pub/sub mesh.

Root Cause

The root cause is missing input validation on protocol-level array lengths. The maintainers relied on protobuf decoding without enforcing per-field size caps. Because the runtime is single-threaded, any unbounded synchronous loop over attacker-controlled data becomes a resource exhaustion primitive.

Attack Vector

Exploitation requires only network reachability to the target gossipsub peer. No authentication or user interaction is needed. An attacker connects as a normal libp2p peer, joins a topic mesh, and sends a crafted RPC containing large IHAVE or IWANT arrays. Each frame stalls the event loop, and repeated frames sustain the denial-of-service condition.

typescript

// Security patch in packages/gossipsub/src/message/decodeRpc.ts
// fix(gossipsub)!: apply decodeRpcLimits to control messages (#3520)
export const defaultDecodeRpcLimits: DecodeRPCLimits = {
-  maxSubscriptions: Infinity,
-  maxMessages: Infinity,
-  maxIhaveMessageIDs: Infinity,
-  maxIwantMessageIDs: Infinity,
-  maxIdontwantMessageIDs: Infinity,
-  maxControlMessages: Infinity,
-  maxPeerInfos: Infinity
+  // 5000 = GossipsubMaxIHaveLength, used as a generous upper bound for these
+  maxSubscriptions: 5000,
+  maxMessages: 5000,
+  maxIhaveMessageIDs: 5000,
+  maxIwantMessageIDs: 5000,
+  maxControlMessages: 5000,
+  maxIdontwantMessageIDs: 512, // GossipsubIdontwantMaxMessages
+  maxPeerInfos: 16 // GossipsubPrunePeers
}

Source: GitHub Commit 773dd80

Detection Methods for CVE-2026-49866

Indicators of Compromise

Sustained Node.js event loop lag or libuv blocked-thread warnings on gossipsub peers.
Inbound RPC frames near the 4 MB protocol limit containing unusually large IHAVE or IWANT arrays.
Repeated timeouts on gossipsub heartbeats and dropped mesh peers coinciding with traffic from a single remote peer ID.

Detection Strategies

Instrument decodeRpc call sites to log frame sizes and control message array lengths above expected baselines.
Correlate CPU spikes on Node.js processes with libp2p peer connection metadata to attribute abusive peers.
Monitor the gossipsub metrics stream for anomalous IHAVE/IWANT counts per heartbeat window.

Monitoring Recommendations

Track event loop delay using perf_hooks.monitorEventLoopDelay and alert when p99 exceeds normal operating thresholds.
Alert on process-level CPU saturation lasting longer than the gossipsub heartbeat interval.
Log and rate-limit peers that repeatedly send RPCs exceeding the new decode limits.

How to Mitigate CVE-2026-49866

Immediate Actions Required

Upgrade @libp2p/gossipsub to version 16.0.0 or later across all Node.js libp2p deployments.
Audit application code that overrides defaultDecodeRpcLimits and ensure no field is set to Infinity.
Restart affected Node.js processes after upgrade to clear any queued malformed RPC state.

Patch Information

The fix ships in gossipsub-v16.0.0 and applies finite defaults for maxIhaveMessageIDs, maxIwantMessageIDs, maxIdontwantMessageIDs, maxControlMessages, maxSubscriptions, maxMessages, and maxPeerInfos. Technical context is available in the GHSA-cwc9-cp4j-mcvv advisory and the pull request discussion.

Workarounds

Explicitly pass a decodeRpcLimits option to the gossipsub constructor with bounded values matching the patched defaults (5000 for most arrays, 512 for maxIdontwantMessageIDs, 16 for maxPeerInfos).
Restrict inbound libp2p connections to trusted peers using an allowlist or connection gater until the upgrade is deployed.
Place gossipsub workloads behind a network policy that limits per-peer bandwidth to reduce the amplification of oversized frames.

bash

# Upgrade @libp2p/gossipsub to the patched release
npm install @libp2p/gossipsub@^16.0.0

# Verify installed version
npm ls @libp2p/gossipsub