A vulnerability in libp2p-gossipsub allows a remote peer to crash a node by sending a PRUNE control message with an excessively large backoff value. This triggers a panic due to an overflow when calculating the expiry time. The issue requires no special authentication beyond a normal libp2p connection and can be repeatedly exploited after node restarts. The flaw is fixed in version 0.49.3.