CVE-2026-77384: libp2p JavaScript DoS Vulnerability

CVE-2026-77384 Overview

CVE-2026-77384 is a denial-of-service vulnerability in @libp2p/circuit-relay-v2, part of the JavaScript implementation of the libp2p networking stack. The flaw resides in the reservation refresh path in reservation-store.ts. This code reuses the same retimeableSignal across refreshes but unconditionally registers a new abort listener each time. A remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth on relay servers. Sustained refresh traffic exhausts memory and event-loop resources, leading to service disruption. The issue is fixed in version 4.2.9.

Critical Impact
A remote unauthenticated peer can trigger unbounded memory growth on circuit-relay-v2 relay servers, resulting in denial of service.

Affected Products

@libp2p/circuit-relay-v2 prior to version 4.2.9
js-libp2p deployments exposing relay-server functionality
Peer-to-peer JavaScript applications acting as circuit relays

Discovery Timeline

2026-08-24 - CVE-2026-77384 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-77384

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw [CWE-400] in the reservation store of the circuit-relay-v2 server. When a peer issues a RESERVE request, the relay creates or refreshes a reservation entry keyed by peer ID. The reservation carries a retimeableSignal whose expiry can be extended without allocating a new signal object. However, the surrounding code attached a new 'abort' event listener on every call, regardless of whether the signal was newly created or reused.

Each refresh therefore appended another closure to the signal's listener list. The closure captured this.reservations and the peer identifier, preventing garbage collection. Because a remote peer controls refresh timing, an attacker could drive listener count and heap size upward without bound.

Root Cause

The defect is an unconditional side effect in a code path that has two modes: create and refresh. The listener registration belonged only in the create branch. Placing it after the branch caused refresh operations to accumulate listeners on the shared signal, violating the invariant that one signal maps to one deletion handler.

Attack Vector

Exploitation requires only network reachability to a relay-server endpoint and the ability to complete libp2p handshakes. An attacker establishes a reservation and then repeatedly sends valid RESERVE messages to refresh it. No authentication, elevated privileges, or user interaction is required.

typescript

         limit: checkedLimit,
         signal: retimeableSignal(this.reservationTtl)
       }
+
+      // only register the abort listener when a new signal is created:
+      // refreshing an existing reservation reuses the same signal, so attaching
+      // a listener on every refresh would leak one listener per refresh
+      reservation.signal.addEventListener('abort', () => {
+        this.reservations.delete(peer)
+      })
     }
 
     this.reservations.set(peer, reservation)
 
-    reservation.signal.addEventListener('abort', () => {
-      this.reservations.delete(peer)
-    })
-
     // return expiry time in seconds
     return { status: Status.OK, expire: Math.round(expiry.getTime() / 1000) }
   }

Source: GitHub Commit 4bb8fbe. The patch moves listener registration inside the branch that allocates a new reservation, so refresh operations no longer attach duplicate handlers.

Detection Methods for CVE-2026-77384

Indicators of Compromise

Steadily rising Node.js heap size on relay-server processes without a corresponding increase in unique peers.
Warnings such as MaxListenersExceededWarning referencing AbortSignal or EventTarget in relay logs.
High-frequency RESERVE requests originating from a small set of remote peer IDs.
Increased event-loop lag or degraded relay throughput preceding a crash or OOM kill.

Detection Strategies

Instrument the circuit-relay-v2 server to record reservation refresh rates per peer and alert on peers exceeding a reasonable baseline.
Track process-level heap and listener counts using Node.js diagnostics (process.memoryUsage(), getEventListeners).
Correlate libp2p protocol traffic with node health metrics to identify refresh-driven memory growth.

Monitoring Recommendations

Enable structured logging on @libp2p/circuit-relay-v2 and forward events to a centralized analytics pipeline.
Set alerts on repeated RESERVE operations from the same peer within short intervals.
Monitor relay-server container restarts and OOM events, correlating with upstream peer behavior.

How to Mitigate CVE-2026-77384

Immediate Actions Required

Upgrade @libp2p/circuit-relay-v2 to version 4.2.9 or later across all relay-server deployments.
Audit dependency trees in js-libp2p applications to confirm no transitive pins remain on affected versions.
Restart long-running relay processes after upgrading to release accumulated listeners and closures.

Patch Information

The fix is released in circuit-relay-v2 v4.2.9. Details are documented in GHSA-x787-gh7p-hmq7. The corrective commit is 4bb8fbe, which relocates the abort listener registration into the reservation-creation branch.

Workarounds

Disable the circuit-relay-v2 server role on nodes that do not need to provide relay services.
Apply upstream rate limiting on RESERVE requests per peer at the transport or application layer.
Restart affected relay processes on a scheduled basis to reset in-memory listener state until patched.

bash

# Upgrade the affected package to the fixed version
npm install @libp2p/circuit-relay-v2@^4.2.9

# Verify the resolved version in your project
npm ls @libp2p/circuit-relay-v2