Advisories · Technology

@libp2p floodsub.

Every CVE that names @libp2p floodsub among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-86040 CVE record

CVSS 7.5 High

libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
- js-libp2p
- @libp2p floodsub
- Denial of service
Not analysed yet 17 Sept 2026