DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-86039: CVE-2026-86039: Signature Verification Bypass and Address Book Poisoning in @libp2p/peer-store

#security #cve #cybersecurity

CVE-2026-86039: Signature Verification Bypass and Address Book Poisoning in @libp2p/peer-store

Vulnerability ID: CVE-2026-86039
CVSS Score: 8.2
Published: 2026-09-17

A logic verification vulnerability in @libp2p/peer-store (part of the js-libp2p ecosystem) allows unauthenticated remote attackers to bypass identity verification and poison a victim node's peer store database with arbitrary network multiaddresses. This occurs because consumePeerRecord() fails to ensure that the signature's identity matches the inner record payload's identity.

TL;DR

The consumePeerRecord() function verifies the signature of a wrapping envelope but does not validate that the signer's identity equals the peer ID specified inside the payload, allowing attackers to poison address stores of network nodes.

Technical Details

  • CWE ID: CWE-290 / CWE-345
  • Attack Vector: Network
  • CVSS Score: 8.2 (High)
  • EPSS Score: N/A
  • Impact: Integrity (High), Availability (Low)
  • Exploit Status: None (No public PoC)
  • KEV Status: Not in CISA KEV

Affected Systems

  • js-libp2p ecosystem applications
  • libp2p-based decentralized nodes
  • @libp2p/peer-store users
  • @libp2p/peer-store: >= 8.0.0 < 12.0.24 (Fixed in: 12.0.24)

Code Analysis

Commit: 3bf5d39

fix: ensure peer record peer id matches envelope signer peer id

Mitigation Strategies

  • Upgrade @libp2p/peer-store to 12.0.24 or higher
  • Implement logging and alerting on mismatch warnings
  • Disable Gossipsub PX if not strictly required in trusted environments

Remediation Steps:

  1. Analyze the project dependency tree to locate vulnerable versions of @libp2p/peer-store (< 12.0.24).
  2. Update the manifest file (package.json) to declare @libp2p/peer-store v12.0.24 or higher.
  3. Rebuild the dependency lockfile (package-lock.json or yarn.lock) and deploy the updated application.
  4. Configure log analysis rules to monitor for the 'signing key did not match peer id' signature.

References

Read the full report for CVE-2026-86039 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)