CVE-2026-77384: CWE-400: Uncontrolled Resource Consumption in libp2p js-libp2p
Description
CVE-2026-77384 is a high-severity vulnerability in the JavaScript implementation of libp2p (js-libp2p) prior to version 4.2.9. It involves uncontrolled resource consumption due to repeated registration of abort listeners on every reservation refresh in the reservation-store.ts component. This flaw allows a remote peer to send repeated valid RESERVE requests, causing unbounded growth of listeners and closures in @libp2p/circuit-relay-v2 relay servers, leading to denial of service. The issue is fixed in version 4.2.9.
CVSS v3.1
Score 7.5high
Affected software
libp2p
js-libp2p
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in js-libp2p before 4.2.9 stems from the reservation refresh path reusing the same retimeableSignal but unconditionally adding a new abort listener on each refresh. This results in unbounded listener and closure growth when a remote peer repeatedly sends valid RESERVE requests for the same reservation. The resource exhaustion affects @libp2p/circuit-relay-v2 relay servers and can cause denial of service. The problem is addressed by a fix in version 4.2.9.
Potential Impact
An attacker can cause denial of service on relay servers by repeatedly sending valid RESERVE requests, triggering unbounded resource consumption due to listener and closure buildup. This does not impact confidentiality or integrity but results in service disruption.
Mitigation Recommendations
Upgrade js-libp2p to version 4.2.9 or later, where the issue is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:36:13.806Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8cb63cacd9273b4924aae4
Added to database: 08/24/2026, 21:23:08 UTC
Last enriched: 09/10/2026, 08:37:46 UTC
Last updated: 10/07/2026, 06:48:18 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.