A vulnerability in libp2p-gossipsub prior to version 0.49.4 allows a remote peer to cause a panic and crash the node by sending a PRUNE message with a carefully crafted backoff time. The issue arises from unchecked time arithmetic that can overflow during heartbeat processing. The flaw is fixed in version 0.49.4 by capping the backoff time and using checked arithmetic operations.