Threats affecting pkg:github/nimiq/network-libp2p

A reachable assertion vulnerability exists in Nimiq's network-libp2p prior to version 1.3.0. The network-libp2p discovery protocol handler incorrectly assumes only one inbound and one outbound discovery substream per connection. If a remote peer opens a second discovery substream on the same connection, the handler triggers a panic, causing the networking task to crash and the node's p2p networking to go offline until restarted. This denial-of-service condition affects availability but does not impact confidentiality or integrity. The issue is fixed in version 1.3.0. No known workarounds are available.

CVE-2026-34062 is a medium severity vulnerability in the nimiq network-libp2p prior to version 1.3.0. It involves allocation of resources without limits or throttling, where inbound substreams can be kept open indefinitely by a remote peer sending only partial frames. This leads to a larger stalled-slot budget than intended, potentially causing denial of service by exhausting resources. The issue is addressed in version 1.3.0, which includes a formal patch. No known workarounds exist.