High
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
Type: advisorySources: OSV
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86039
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 23:45 UTC · Revision 1
Source evidence
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
core-osv · Original sourcePublished 17 Sept 2026, 15:19 UTC
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.
osv:CVE-2026-86039
Complete source record
{
"id": "26afd15a311eb3a5edf95ea81fa22e44c64eaf2f6683bd17d67a4ef5bde608fd",
"url": "https://osv.dev/vulnerability/CVE-2026-86039",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses",
"summary": "libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.",
"evidence": "osv:CVE-2026-86039",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-86039",
"aliases": [
"CVE-2026-86039",
"GHSA-vrf4-mx87-p53w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libp2p/js-libp2p",
"type": "GIT",
"events": [
{
"introduced": "08eb47154168f894a0b4847dcf4f42ff52e8420e"
},
{
"fixed": "cf0dbb38a2bc86e4346660c804a873fefbbeab49"
},
{
"fixed": "3bf5d395cbca1488eea6e87cd771e4613b661c30"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "12.0.24"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "3bf5d395cbca1488eea6e87cd771e4613b661c30"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "cf0dbb38a2bc86e4346660c804a873fefbbeab49"
}
],
"source": "REFERENCES_TAG",
"original_tag": "peer-store-v12.0.24"
}
]
}
}
],
"versions": [
"webtransport-v6.0.31",
"websockets-v10.1.16",
"webrtc-v6.0.26",
"utils-v7.2.4",
"upnp-nat-v4.0.23",
"transport-interop-libp2p-main-v1.0.32",
"tls-v3.1.5",
"tcp-v11.0.23",
"simple-metrics-v2.0.18",
"record-v4.0.15",
"prometheus-metrics-v5.0.24",
"pnet-v3.0.24",
"plaintext-v3.0.23",
"ping-v3.1.8",
"perf-v5.1.8",
"peer-store-v12.0.23",
"peer-record-v9.0.13",
"peer-id-v6.0.12",
"peer-collections-v7.0.23",
"opentelemetry-metrics-v2.0.24",
"multistream-select-v7.0.23",
"mplex-v12.0.26",
"memory-v2.0.23",
"mdns-v12.0.26",
"logger-v6.2.10",
"libp2p-v3.3.5",
"keychain-v6.1.4",
"kad-dht-v16.3.4",
"interop-v14.0.31",
"interface-v3.2.5",
"interface-internal-v3.1.8",
"interface-compliance-tests-v7.0.26",
"integration-tests-v1.2.15",
"identify-v4.1.9",
"gossipsub-v16.0.4",
"floodsub-v11.0.25",
"fetch-v4.1.8",
"echo-v3.1.8",
"dcutr-v3.0.23",
"daemon-v6.0.31",
"daemon-server-v9.0.31",
"daemon-protocol-v8.0.10",
"daemon-client-v10.0.31",
"crypto-v5.1.21",
"config-v1.1.34",
"circuit-relay-v2-v4.2.8",
"bootstrap-v12.0.26",
"autonat-v3.0.23",
"autonat-v2-v2.0.23",
"webtransport-v6.0.30",
"websockets-v10.1.15",
"webrtc-v6.0.25",
"utils-v7.2.3",
"upnp-nat-v4.0.22",
"transport-interop-libp2p-main-v1.0.31",
"tls-v3.1.4",
"tcp-v11.0.22",
"simple-metrics-v2.0.17",
"record-v4.0.14",
"prometheus-metrics-v5.0.23",
"pnet-v3.0.23",
"plaintext-v3.0.22",
"ping-v3.1.7",
"perf-v5.1.7",
"peer-store-v12.0.22",
"peer-record-v9.0.12",
"peer-id-v6.0.11",
"peer-collections-v7.0.22",
"opentelemetry-metrics-v2.0.23",
"multistream-select-v7.0.22",
"mplex-v12.0.25",
"memory-v2.0.22",
"mdns-v12.0.25",
"logger-v6.2.9",
"libp2p-v3.3.4",
"keychain-v6.1.3",
"kad-dht-v16.3.3",
"interop-v14.0.30",
"interface-v3.2.4",
"interface-internal-v3.1.7",
"interface-compliance-tests-v7.0.25",
"integration-tests-v1.2.14",
"identify-v4.1.8",
"gossipsub-v16.0.3",
"floodsub-v11.0.24",
"fetch-v4.1.7",
"echo-v3.1.7",
"dcutr-v3.0.22",
"daemon-v6.0.30",
"daemon-server-v9.0.30",
"daemon-protocol-v8.0.9",
"daemon-client-v10.0.30",
"crypto-v5.1.20",
"config-v1.1.33",
"circuit-relay-v2-v4.2.7",
"bootstrap-v12.0.25",
"autonat-v3.0.22",
"autonat-v2-v2.0.22",
"webtransport-v6.0.29",
"transport-interop-libp2p-main-v1.0.30",
"kad-dht-v16.3.2",
"interop-v14.0.29",
"integration-tests-v1.2.13",
"gossipsub-v16.0.2",
"daemon-v6.0.29",
"daemon-server-v9.0.29",
"daemon-client-v10.0.29",
"webtransport-v6.0.28",
"websockets-v10.1.14",
"webrtc-v6.0.24",
"utils-v7.2.2",
"upnp-nat-v4.0.21",
"transport-interop-libp2p-main-v1.0.29",
"tls-v3.1.3",
"tcp-v11.0.21",
"simple-metrics-v2.0.16",
"record-v4.0.13",
"prometheus-metrics-v5.0.22",
"pnet-v3.0.22",
"plaintext-v3.0.21",
"ping-v3.1.6",
"perf-v5.1.6",
"peer-store-v12.0.21",
"peer-record-v9.0.11",
"peer-id-v6.0.10",
"peer-collections-v7.0.21",
"opentelemetry-metrics-v2.0.22",
"multistream-select-v7.0.21",
"mplex-v12.0.24",
"memory-v2.0.21",
"mdns-v12.0.24",
"logger-v6.2.8",
"libp2p-v3.3.3",
"keychain-v6.1.2",
"kad-dht-v16.3.1",
"interop-v14.0.28",
"interface-v3.2.3",
"interface-internal-v3.1.6",
"interface-compliance-tests-v7.0.24",
"integration-tests-v1.2.12",
"identify-v4.1.7",
"gossipsub-v16.0.1",
"floodsub-v11.0.23",
"fetch-v4.1.6",
"echo-v3.1.6",
"dcutr-v3.0.21",
"daemon-v6.0.28",
"daemon-server-v9.0.28",
"daemon-protocol-v8.0.8",
"daemon-client-v10.0.28",
"crypto-v5.1.19",
"config-v1.1.32",
"circuit-relay-v2-v4.2.6",
"bootstrap-v12.0.24",
"autonat-v3.0.21",
"autonat-v2-v2.0.21",
"webtransport-v6.0.27",
"transport-interop-libp2p-main-v1.0.28",
"mplex-v12.0.23",
"mdns-v12.0.23",
"libp2p-v3.3.2",
"interop-v14.0.27",
"interface-compliance-tests-v7.0.23",
"integration-tests-v1.2.11",
"gossipsub-v16.0.0",
"floodsub-v11.0.22",
"daemon-v6.0.27",
"daemon-server-v9.0.27",
"daemon-client-v10.0.27",
"bootstrap-v12.0.23",
"webtransport-v6.0.26",
"transport-interop-libp2p-main-v1.0.27",
"kad-dht-v16.3.0",
"interop-v14.0.26",
"integration-tests-v1.2.10",
"daemon-v6.0.26",
"daemon-server-v9.0.26",
"daemon-client-v10.0.26",
"webtransport-v6.0.25",
"websockets-v10.1.13",
"webrtc-v6.0.23",
"utils-v7.2.1",
"upnp-nat-v4.0.20",
"transport-interop-libp2p-main-v1.0.26",
"tls-v3.1.2",
"tcp-v11.0.20",
"prometheus-metrics-v5.0.21",
"pnet-v3.0.21",
"plaintext-v3.0.20",
"ping-v3.1.5",
"perf-v5.1.5",
"peer-store-v12.0.20",
"peer-collections-v7.0.20",
"opentelemetry-metrics-v2.0.21",
"multistream-select-v7.0.20",
"mplex-v12.0.22",
"memory-v2.0.20",
"mdns-v12.0.22",
"libp2p-v3.3.1",
"kad-dht-v16.2.7",
"interop-v14.0.25",
"interface-internal-v3.1.5",
"interface-compliance-tests-v7.0.22",
"integration-tests-v1.2.9",
"identify-v4.1.6",
"gossipsub-v15.0.23",
"floodsub-v11.0.21",
"fetch-v4.1.5",
"echo-v3.1.5",
"dcutr-v3.0.20",
"daemon-v6.0.25",
"daemon-server-v9.0.25",
"daemon-client-v10.0.25",
"circuit-relay-v2-v4.2.5",
"bootstrap-v12.0.22",
"autonat-v3.0.20",
"autonat-v2-v2.0.20",
"webtransport-v6.0.24",
"transport-interop-libp2p-main-v1.0.25",
"kad-dht-v16.2.6",
"interop-v14.0.24",
"integration-tests-v1.2.8",
"daemon-v6.0.24",
"daemon-server-v9.0.24",
"daemon-client-v10.0.24",
"transport-interop-libp2p-main-v1.0.24",
"integration-tests-v1.2.7",
"identify-v4.1.5",
"webtransport-v6.0.23",
"websockets-v10.1.12",
"webrtc-v6.0.22",
"utils-v7.2.0",
"upnp-nat-v4.0.19",
"transport-interop-libp2p-main-v1.0.23",
"tls-v3.1.1",
"tcp-v11.0.19",
"simple-metrics-v2.0.15",
"prometheus-metrics-v5.0.20",
"pnet-v3.0.20",
"plaintext-v3.0.19",
"ping-v3.1.4",
"perf-v5.1.4",
"peer-store-v12.0.19",
"peer-record-v9.0.10",
"peer-id-v6.0.9",
"peer-collections-v7.0.19",
"opentelemetry-metrics-v2.0.20",
"multistream-select-v7.0.19",
"mplex-v12.0.21",
"memory-v2.0.19",
"mdns-v12.0.21",
"logger-v6.2.7",
"libp2p-v3.3.0",
"keychain-v6.1.1",
"kad-dht-v16.2.5",
"interop-v14.0.23",
"interface-internal-v3.1.4",
"interface-compliance-tests-v7.0.21",
"integration-tests-v1.2.6",
"identify-v4.1.4",
"gossipsub-v15.0.22",
"floodsub-v11.0.20",
"fetch-v4.1.4",
"echo-v3.1.4",
"dcutr-v3.0.19",
"daemon-v6.0.23",
"daemon-server-v9.0.23",
"daemon-client-v10.0.23",
"crypto-v5.1.18",
"config-v1.1.31",
"circuit-relay-v2-v4.2.4",
"bootstrap-v12.0.21",
"autonat-v3.0.19",
"autonat-v2-v2.0.19",
"webtransport-v6.0.22",
"webrtc-v6.0.21",
"transport-interop-libp2p-main-v1.0.22",
"mplex-v12.0.20",
"mdns-v12.0.20",
"libp2p-v3.2.4",
"interop-v14.0.22",
"interface-compliance-tests-v7.0.20",
"integration-tests-v1.2.5",
"gossipsub-v15.0.21",
"daemon-v6.0.22",
"daemon-server-v9.0.22",
"daemon-client-v10.0.22",
"bootstrap-v12.0.20",
"webtransport-v6.0.21",
"websockets-v10.1.11",
"webrtc-v6.0.20",
"utils-v7.1.0",
"upnp-nat-v4.0.18",
"transport-interop-libp2p-main-v1.0.21",
"tls-v3.1.0",
"tcp-v11.0.18",
"prometheus-metrics-v5.0.19",
"pnet-v3.0.19",
"plaintext-v3.0.18",
"ping-v3.1.3",
"perf-v5.1.3",
"peer-store-v12.0.18",
"peer-collections-v7.0.18",
"opentelemetry-metrics-v2.0.19",
"multistream-select-v7.0.18",
"mplex-v12.0.19",
"memory-v2.0.18",
"mdns-v12.0.19",
"libp2p-v3.2.3",
"keychain-v6.1.0",
"kad-dht-v16.2.4",
"interop-v14.0.21",
"interface-internal-v3.1.3",
"interface-compliance-tests-v7.0.19",
"integration-tests-v1.2.4",
"identify-v4.1.3",
"gossipsub-v15.0.20",
"floodsub-v11.0.19",
"fetch-v4.1.3",
"echo-v3.1.3",
"dcutr-v3.0.18",
"daemon-v6.0.21",
"daemon-server-v9.0.21",
"daemon-client-v10.0.21",
"config-v1.1.30",
"circuit-relay-v2-v4.2.3",
"bootstrap-v12.0.19",
"autonat-v3.0.18",
"autonat-v2-v2.0.18",
"webtransport-v6.0.20",
"webrtc-v6.0.19",
"transport-interop-libp2p-main-v1.0.20",
"kad-dht-v16.2.3",
"interop-v14.0.20",
"integration-tests-v1.2.3",
"daemon-v6.0.20",
"daemon-server-v9.0.20",
"daemon-client-v10.0.20",
"webtransport-v6.0.19",
"websockets-v10.1.10",
"webrtc-v6.0.18",
"utils-v7.0.17",
"upnp-nat-v4.0.17",
"transport-interop-libp2p-main-v1.0.19",
"tls-v3.0.17",
"tcp-v11.0.17",
"simple-metrics-v2.0.14",
"record-v4.0.12",
"prometheus-metrics-v5.0.18",
"pnet-v3.0.18",
"plaintext-v3.0.17",
"ping-v3.1.2",
"perf-v5.1.2",
"peer-store-v12.0.17",
"peer-record-v9.0.9",
"peer-id-v6.0.8",
"peer-collections-v7.0.17",
"opentelemetry-metrics-v2.0.18",
"multistream-select-v7.0.17",
"mplex-v12.0.18",
"memory-v2.0.17",
"mdns-v12.0.18",
"logger-v6.2.6",
"libp2p-v3.2.2",
"keychain-v6.0.14",
"kad-dht-v16.2.2",
"interop-v14.0.19",
"interface-v3.2.2",
"interface-internal-v3.1.2",
"interface-compliance-tests-v7.0.18",
"integration-tests-v1.2.2",
"identify-v4.1.2",
"gossipsub-v15.0.19",
"floodsub-v11.0.18",
"fetch-v4.1.2",
"echo-v3.1.2",
"dcutr-v3.0.17",
"daemon-v6.0.19",
"daemon-server-v9.0.19",
"daemon-protocol-v8.0.7",
"daemon-client-v10.0.19",
"crypto-v5.1.17",
"config-v1.1.29",
"circuit-relay-v2-v4.2.2",
"bootstrap-v12.0.18",
"autonat-v3.0.17",
"autonat-v2-v2.0.17",
"webtransport-v6.0.18",
"websockets-v10.1.9",
"webrtc-v6.0.17",
"utils-v7.0.16",
"upnp-nat-v4.0.16",
"transport-interop-libp2p-main-v1.0.18",
"tls-v3.0.16",
"tcp-v11.0.16",
"simple-metrics-v2.0.13",
"record-v4.0.11",
"prometheus-metrics-v5.0.17",
"pnet-v3.0.17",
"plaintext-v3.0.16",
"ping-v3.1.1",
"perf-v5.1.1",
"peer-store-v12.0.16",
"peer-record-v9.0.8",
"peer-id-v6.0.7",
"peer-collections-v7.0.16",
"opentelemetry-metrics-v2.0.17",
"multistream-select-v7.0.16",
"mplex-v12.0.17",
"memory-v2.0.16",
"mdns-v12.0.17",
"logger-v6.2.5",
"libp2p-v3.2.1",
"keychain-v6.0.13",
"kad-dht-v16.2.1",
"interop-v14.0.18",
"interface-v3.2.1",
"interface-internal-v3.1.1",
"interface-compliance-tests-v7.0.17",
"integration-tests-v1.2.1",
"identify-v4.1.1",
"gossipsub-v15.0.18",
"floodsub-v11.0.17",
"fetch-v4.1.1",
"echo-v3.1.1",
"dcutr-v3.0.16",
"daemon-v6.0.18",
"daemon-server-v9.0.18",
"daemon-protocol-v8.0.6",
"daemon-client-v10.0.18",
"crypto-v5.1.16",
"config-v1.1.28",
"circuit-relay-v2-v4.2.1",
"bootstrap-v12.0.17",
"autonat-v3.0.16",
"autonat-v2-v2.0.16",
"webtransport-v6.0.17",
"websockets-v10.1.8",
"webrtc-v6.0.16",
"utils-v7.0.15",
"upnp-nat-v4.0.15",
"transport-interop-libp2p-main-v1.0.17",
"tls-v3.0.15",
"tcp-v11.0.15",
"simple-metrics-v2.0.12",
"prometheus-metrics-v5.0.16",
"pnet-v3.0.16",
"plaintext-v3.0.15",
"ping-v3.1.0",
"perf-v5.1.0",
"peer-store-v12.0.15",
"peer-record-v9.0.7",
"peer-id-v6.0.6",
"peer-collections-v7.0.15",
"opentelemetry-metrics-v2.0.16",
"multistream-select-v7.0.15",
"mplex-v12.0.16",
"memory-v2.0.15",
"mdns-v12.0.16",
"logger-v6.2.4",
"libp2p-v3.2.0",
"keychain-v6.0.12",
"kad-dht-v16.2.0",
"interop-v14.0.17",
"interface-v3.2.0",
"interface-internal-v3.1.0",
"interface-compliance-tests-v7.0.16",
"integration-tests-v1.2.0",
"identify-v4.1.0",
"gossipsub-v15.0.17",
"floodsub-v11.0.16",
"fetch-v4.1.0",
"echo-v3.1.0",
"dcutr-v3.0.15",
"daemon-v6.0.17",
"daemon-server-v9.0.17",
"daemon-protocol-v8.0.5",
"daemon-client-v10.0.17",
"crypto-v5.1.15",
"config-v1.1.27",
"circuit-relay-v2-v4.2.0",
"bootstrap-v12.0.16",
"autonat-v3.0.15",
"autonat-v2-v2.0.15",
"webtransport-v6.0.16",
"websockets-v10.1.7",
"webrtc-v6.0.15",
"utils-v7.0.14",
"upnp-nat-v4.0.14",
"transport-interop-libp2p-main-v1.0.16",
"tls-v3.0.14",
"tcp-v11.0.14",
"simple-metrics-v2.0.11",
"record-v4.0.10",
"prometheus-metrics-v5.0.15",
"pnet-v3.0.15",
"plaintext-v3.0.14",
"ping-v3.0.14",
"perf-v5.0.15",
"peer-store-v12.0.14",
"peer-record-v9.0.6",
"peer-id-v6.0.5",
"peer-collections-v7.0.14",
"opentelemetry-metrics-v2.0.15",
"multistream-select-v7.0.14",
"mplex-v12.0.15",
"memory-v2.0.14",
"mdns-v12.0.15",
"logger-v6.2.3",
"libp2p-v3.1.7",
"keychain-v6.0.11",
"kad-dht-v16.1.7",
"interop-v14.0.16",
"interface-v3.1.1",
"interface-internal-v3.0.14",
"interface-compliance-tests-v7.0.15",
"integration-tests-v1.1.7",
"identify-v4.0.14",
"gossipsub-v15.0.16",
"floodsub-v11.0.15",
"fetch-v4.0.14",
"echo-v3.0.15",
"dcutr-v3.0.14",
"daemon-v6.0.16",
"daemon-server-v9.0.16",
"daemon-protocol-v8.0.4",
"daemon-client-v10.0.16",
"crypto-v5.1.14",
"config-v1.1.26",
"circuit-relay-v2-v4.1.7",
"bootstrap-v12.0.15",
"autonat-v3.0.14",
"autonat-v2-v2.0.14",
"webtransport-v6.0.15",
"websockets-v10.1.6",
"webrtc-v6.0.14",
"utils-v7.0.13",
"upnp-nat-v4.0.13",
"transport-interop-libp2p-main-v1.0.15",
"tls-v3.0.13",
"tcp-v11.0.13",
"prometheus-metrics-v5.0.14",
"pnet-v3.0.14",
"plaintext-v3.0.13",
"ping-v3.0.13",
"perf-v5.0.14",
"peer-store-v12.0.13",
"peer-collections-v7.0.13",
"opentelemetry-metrics-v2.0.14",
"multistream-select-v7.0.13",
"mplex-v12.0.14",
"memory-v2.0.13",
"mdns-v12.0.14",
"libp2p-v3.1.6",
"kad-dht-v16.1.6",
"interop-v14.0.15",
"interface-internal-v3.0.13",
"interface-compliance-tests-v7.0.14",
"integration-tests-v1.1.6",
"identify-v4.0.13",
"gossipsub-v15.0.15",
"floodsub-v11.0.14",
"fetch-v4.0.13",
"echo-v3.0.14",
"dcutr-v3.0.13",
"daemon-v6.0.15",
"daemon-server-v9.0.15",
"daemon-client-v10.0.15",
"circuit-relay-v2-v4.1.6",
"bootstrap-v12.0.14",
"autonat-v3.0.13",
"autonat-v2-v2.0.13",
"webtransport-v6.0.12",
"websockets-v10.1.3",
"webrtc-v6.0.11",
"utils-v7.0.10",
"upnp-nat-v4.0.10",
"transport-interop-libp2p-main-v1.0.12",
"tls-v3.0.10",
"tcp-v11.0.10",
"record-v4.0.9",
"prometheus-metrics-v5.0.10",
"pnet-v3.0.11",
"plaintext-v3.0.10",
"ping-v3.0.10",
"perf-v5.0.11",
"peer-store-v12.0.10",
"peer-record-v9.0.5",
"peer-collections-v7.0.10",
"opentelemetry-metrics-v2.0.10",
"multistream-select-v7.0.10",
"mplex-v12.0.11",
"memory-v2.0.10",
"mdns-v12.0.11",
"libp2p-v3.1.3",
"keychain-v6.0.10",
"kad-dht-v16.1.3",
"interop-v14.0.12",
"interface-internal-v3.0.10",
"interface-compliance-tests-v7.0.11",
"integration-tests-v1.1.3",
"identify-v4.0.10",
"gossipsub-v15.0.12",
"floodsub-v11.0.11",
"fetch-v4.0.10",
"echo-v3.0.11",
"dcutr-v3.0.10",
"daemon-v6.0.12",
"daemon-server-v9.0.12",
"daemon-client-v10.0.12",
"config-v1.1.25",
"circuit-relay-v2-v4.1.3",
"bootstrap-v12.0.11",
"autonat-v3.0.10",
"autonat-v2-v2.0.10",
"simple-metrics-v2.0.10",
"prometheus-metrics-v5.0.13",
"opentelemetry-metrics-v2.0.13",
"webtransport-v6.0.14",
"websockets-v10.1.5",
"webrtc-v6.0.13",
"utils-v7.0.12",
"upnp-nat-v4.0.12",
"transport-interop-libp2p-main-v1.0.14",
"tls-v3.0.12",
"tcp-v11.0.12",
"prometheus-metrics-v5.0.12",
"pnet-v3.0.13",
"plaintext-v3.0.12",
"ping-v3.0.12",
"perf-v5.0.13",
"peer-store-v12.0.12",
"peer-collections-v7.0.12",
"opentelemetry-metrics-v2.0.12",
"multistream-select-v7.0.12",
"mplex-v12.0.13",
"memory-v2.0.12",
"mdns-v12.0.13",
"libp2p-v3.1.5",
"kad-dht-v16.1.5",
"interop-v14.0.14",
"interface-internal-v3.0.12",
"interface-compliance-tests-v7.0.13",
"integration-tests-v1.1.5",
"identify-v4.0.12",
"gossipsub-v15.0.14",
"floodsub-v11.0.13",
"fetch-v4.0.12",
"echo-v3.0.13",
"dcutr-v3.0.12",
"daemon-v6.0.14",
"daemon-server-v9.0.14",
"daemon-client-v10.0.14",
"circuit-relay-v2-v4.1.5",
"bootstrap-v12.0.13",
"autonat-v3.0.12",
"autonat-v2-v2.0.12",
"webtransport-v6.0.13",
"websockets-v10.1.4",
"webrtc-v6.0.12",
"utils-v7.0.11",
"upnp-nat-v4.0.11",
"transport-interop-libp2p-main-v1.0.13",
"tls-v3.0.11",
"tcp-v11.0.11",
"prometheus-metrics-v5.0.11",
"pnet-v3.0.12",
"plaintext-v3.0.11",
"ping-v3.0.11",
"perf-v5.0.12",
"peer-store-v12.0.11",
"peer-collections-v7.0.11",
"opentelemetry-metrics-v2.0.11",
"multistream-select-v7.0.11",
"mplex-v12.0.12",
"memory-v2.0.11",
"mdns-v12.0.12",
"libp2p-v3.1.4",
"kad-dht-v16.1.4",
"interop-v14.0.13",
"interface-internal-v3.0.11",
"interface-compliance-tests-v7.0.12",
"integration-tests-v1.1.4",
"identify-v4.0.11",
"gossipsub-v15.0.13",
"floodsub-v11.0.12",
"fetch-v4.0.11",
"echo-v3.0.12",
"dcutr-v3.0.11",
"daemon-v6.0.13",
"daemon-server-v9.0.13",
"daemon-client-v10.0.13",
"circuit-relay-v2-v4.1.4",
"bootstrap-v12.0.12",
"autonat-v3.0.11",
"autonat-v2-v2.0.11",
"webtransport-v6.0.11",
"websockets-v10.1.2",
"webrtc-v6.0.10",
"utils-v7.0.9",
"upnp-nat-v4.0.9",
"transport-interop-libp2p-main-v1.0.11",
"tls-v3.0.9",
"tcp-v11.0.9",
"simple-metrics-v2.0.9",
"prometheus-metrics-v5.0.9",
"pnet-v3.0.10",
"plaintext-v3.0.9",
"ping-v3.0.9",
"perf-v5.0.10",
"peer-store-v12.0.9",
"peer-collections-v7.0.9",
"opentelemetry-metrics-v2.0.9",
"multistream-select-v7.0.9",
"mplex-v12.0.10",
"memory-v2.0.9",
"mdns-v12.0.10",
"logger-v6.2.2",
"libp2p-v3.1.2",
"keychain-v6.0.9",
"kad-dht-v16.1.2",
"interop-v14.0.11",
"interface-internal-v3.0.9",
"interface-compliance-tests-v7.0.10",
"integration-tests-v1.1.2",
"identify-v4.0.9",
"gossipsub-v15.0.11",
"floodsub-v11.0.10",
"fetch-v4.0.9",
"echo-v3.0.10",
"dcutr-v3.0.9",
"daemon-v6.0.11",
"daemon-server-v9.0.11",
"daemon-client-v10.0.11",
"config-v1.1.24",
"circuit-relay-v2-v4.1.2",
"bootstrap-v12.0.10",
"autonat-v3.0.9",
"autonat-v2-v2.0.9",
"webtransport-v6.0.10",
"websockets-v10.1.1",
"webrtc-v6.0.9",
"utils-v7.0.8",
"upnp-nat-v4.0.8",
"transport-interop-libp2p-main-v1.0.10",
"tls-v3.0.8",
"tcp-v11.0.8",
"simple-metrics-v2.0.8",
"prometheus-metrics-v5.0.8",
"pnet-v3.0.9",
"plaintext-v3.0.8",
"ping-v3.0.8",
"perf-v5.0.9",
"peer-store-v12.0.8",
"peer-collections-v7.0.8",
"opentelemetry-metrics-v2.0.8",
"multistream-select-v7.0.8",
"mplex-v12.0.9",
"memory-v2.0.8",
"mdns-v12.0.9",
"logger-v6.2.1",
"libp2p-v3.1.1",
"keychain-v6.0.8",
"kad-dht-v16.1.1",
"interop-v14.0.10",
"interface-internal-v3.0.8",
"interface-compliance-tests-v7.0.9",
"integration-tests-v1.1.1",
"identify-v4.0.8",
"gossipsub-v15.0.10",
"floodsub-v11.0.9",
"fetch-v4.0.8",
"echo-v3.0.9",
"dcutr-v3.0.8",
"daemon-v6.0.10",
"daemon-server-v9.0.10",
"daemon-client-v10.0.10",
"config-v1.1.23",
"circuit-relay-v2-v4.1.1",
"bootstrap-v12.0.9",
"autonat-v3.0.8",
"autonat-v2-v2.0.8",
"webtransport-v6.0.9",
"websockets-v10.1.0",
"webrtc-v6.0.8",
"utils-v7.0.7",
"upnp-nat-v4.0.7",
"transport-interop-libp2p-main-v1.0.9",
"tls-v3.0.7",
"tcp-v11.0.7",
"simple-metrics-v2.0.7",
"prometheus-metrics-v5.0.7",
"pnet-v3.0.8",
"plaintext-v3.0.7",
"ping-v3.0.7",
"perf-v5.0.8",
"peer-store-v12.0.7",
"peer-record-v9.0.4",
"peer-id-v6.0.4",
"peer-collections-v7.0.7",
"opentelemetry-metrics-v2.0.7",
"multistream-select-v7.0.7",
"mplex-v12.0.8",
"memory-v2.0.7",
"mdns-v12.0.8",
"logger-v6.2.0",
"libp2p-v3.1.0",
"keychain-v6.0.7",
"kad-dht-v16.1.0",
"interop-v14.0.9",
"interface-v3.1.0",
"interface-internal-v3.0.7",
"interface-compliance-tests-v7.0.8",
"integration-tests-v1.1.0",
"identify-v4.0.7",
"gossipsub-v15.0.9",
"floodsub-v11.0.8",
"fetch-v4.0.7",
"echo-v3.0.8",
"dcutr-v3.0.7",
"daemon-v6.0.9",
"daemon-server-v9.0.9",
"daemon-protocol-v8.0.3",
"daemon-client-v10.0.9",
"crypto-v5.1.13",
"config-v1.1.22",
"circuit-relay-v2-v4.1.0",
"bootstrap-v12.0.8",
"autonat-v3.0.7",
"autonat-v2-v2.0.7",
"webtransport-v6.0.8",
"websockets-v10.0.7",
"webrtc-v6.0.7",
"utils-v7.0.6",
"upnp-nat-v4.0.6",
"transport-interop-libp2p-main-v1.0.8",
"tls-v3.0.6",
"tcp-v11.0.6",
"simple-metrics-v2.0.6",
"prometheus-metrics-v5.0.6",
"pnet-v3.0.7",
"plaintext-v3.0.6",
"ping-v3.0.6",
"perf-v5.0.7",
"peer-store-v12.0.6",
"peer-collections-v7.0.6",
"opentelemetry-metrics-v2.0.6",
"multistream-select-v7.0.6",
"mplex-v12.0.7",
"memory-v2.0.6",
"mdns-v12.0.7",
"logger-v6.1.0",
"libp2p-v3.0.7",
"keychain-v6.0.6",
"kad-dht-v16.0.6",
"interop-v14.0.8",
"interface-internal-v3.0.6",
"interface-compliance-tests-v7.0.7",
"integration-tests-v1.0.8",
"identify-v4.0.6",
"gossipsub-v15.0.8",
"floodsub-v11.0.7",
"fetch-v4.0.6",
"echo-v3.0.7",
"dcutr-v3.0.6",
"daemon-v6.0.8",
"daemon-server-v9.0.8",
"daemon-client-v10.0.8",
"config-v1.1.21",
"circuit-relay-v2-v4.0.6",
"bootstrap-v12.0.7",
"autonat-v3.0.6",
"autonat-v2-v2.0.6",
"webtransport-v6.0.7",
"websockets-v10.0.6",
"webrtc-v6.0.6",
"utils-v7.0.5",
"upnp-nat-v4.0.5",
"transport-interop-libp2p-main-v1.0.7",
"tls-v3.0.5",
"tcp-v11.0.5",
"simple-metrics-v2.0.5",
"prometheus-metrics-v5.0.5",
"pnet-v3.0.6",
"plaintext-v3.0.5",
"ping-v3.0.5",
"perf-v5.0.6",
"peer-store-v12.0.5",
"peer-collections-v7.0.5",
"opentelemetry-metrics-v2.0.5",
"multistream-select-v7.0.5",
"mplex-v12.0.6",
"memory-v2.0.5",
"mdns-v12.0.6",
"logger-v6.0.5",
"libp2p-v3.0.6",
"keychain-v6.0.5",
"kad-dht-v16.0.5",
"interop-v14.0.7",
"interface-internal-v3.0.5",
"interface-compliance-tests-v7.0.6",
"integration-tests-v1.0.7",
"identify-v4.0.5",
"gossipsub-v15.0.7",
"floodsub-v11.0.6",
"fetch-v4.0.5",
"echo-v3.0.6",
"dcutr-v3.0.5",
"daemon-v6.0.7",
"daemon-server-v9.0.7",
"daemon-client-v10.0.7",
"config-v1.1.20",
"circuit-relay-v2-v4.0.5",
"bootstrap-v12.0.6",
"autonat-v3.0.5",
"autonat-v2-v2.0.5",
"webtransport-v6.0.6",
"websockets-v10.0.5",
"webrtc-v6.0.5",
"utils-v7.0.4",
"upnp-nat-v4.0.4",
"transport-interop-libp2p-main-v1.0.6",
"tls-v3.0.4",
"tcp-v11.0.4",
"simple-metrics-v2.0.4",
"prometheus-metrics-v5.0.4",
"pnet-v3.0.5",
"plaintext-v3.0.4",
"ping-v3.0.4",
"perf-v5.0.5",
"peer-store-v12.0.4",
"peer-record-v9.0.3",
"peer-id-v6.0.3",
"peer-collections-v7.0.4",
"opentelemetry-metrics-v2.0.4",
"multistream-select-v7.0.4",
"mplex-v12.0.5",
"memory-v2.0.4",
"mdns-v12.0.5",
"logger-v6.0.4",
"libp2p-v3.0.5",
"keychain-v6.0.4",
"kad-dht-v16.0.4",
"interop-v14.0.6",
"interface-v3.0.2",
"interface-internal-v3.0.4",
"interface-compliance-tests-v7.0.5",
"integration-tests-v1.0.6",
"identify-v4.0.4",
"gossipsub-v15.0.6",
"floodsub-v11.0.5",
"fetch-v4.0.4",
"echo-v3.0.5",
"dcutr-v3.0.4",
"daemon-v6.0.6",
"daemon-server-v9.0.6",
"daemon-protocol-v8.0.2",
"daemon-client-v10.0.6",
"crypto-v5.1.12",
"config-v1.1.19",
"circuit-relay-v2-v4.0.4",
"bootstrap-v12.0.5",
"autonat-v3.0.4",
"autonat-v2-v2.0.4",
"webtransport-v6.0.5",
"websockets-v10.0.4",
"webrtc-v6.0.4",
"utils-v7.0.3",
"upnp-nat-v4.0.3",
"transport-interop-libp2p-main-v1.0.5",
"tls-v3.0.3",
"tcp-v11.0.3",
"simple-metrics-v2.0.3",
"prometheus-metrics-v5.0.3",
"pnet-v3.0.4",
"plaintext-v3.0.3",
"ping-v3.0.3",
"perf-v5.0.4",
"peer-store-v12.0.3",
"peer-record-v9.0.2",
"peer-id-v6.0.2",
"peer-collections-v7.0.3",
"opentelemetry-metrics-v2.0.3",
"multistream-select-v7.0.3",
"mplex-v12.0.4",
"memory-v2.0.3",
"mdns-v12.0.4",
"logger-v6.0.3",
"libp2p-v3.0.4",
"keychain-v6.0.3",
"kad-dht-v16.0.3",
"interop-v14.0.5",
"interface-v3.0.1",
"interface-internal-v3.0.3",
"interface-compliance-tests-v7.0.4",
"integration-tests-v1.0.5",
"identify-v4.0.3",
"gossipsub-v15.0.5",
"floodsub-v11.0.4",
"fetch-v4.0.3",
"echo-v3.0.4",
"dcutr-v3.0.3",
"daemon-v6.0.5",
"daemon-server-v9.0.5",
"daemon-protocol-v8.0.1",
"daemon-client-v10.0.5",
"crypto-v5.1.11",
"config-v1.1.18",
"circuit-relay-v2-v4.0.3",
"bootstrap-v12.0.4",
"autonat-v3.0.3",
"autonat-v2-v2.0.3",
"pnet-v3.0.3",
"webtransport-v6.0.4",
"websockets-v10.0.3",
"webrtc-v6.0.3",
"utils-v7.0.2",
"upnp-nat-v4.0.2",
"transport-interop-libp2p-main-v1.0.4",
"tls-v3.0.2",
"tcp-v11.0.2",
"simple-metrics-v2.0.2",
"prometheus-metrics-v5.0.2",
"pnet-v3.0.2",
"plaintext-v3.0.2",
"ping-v3.0.2",
"perf-v5.0.3",
"peer-store-v12.0.2",
"peer-collections-v7.0.2",
"opentelemetry-metrics-v2.0.2",
"multistream-select-v7.0.2",
"mplex-v12.0.3",
"memory-v2.0.2",
"mdns-v12.0.3",
"logger-v6.0.2",
"libp2p-v3.0.3",
"keychain-v6.0.2",
"kad-dht-v16.0.2",
"interop-v14.0.4",
"interface-internal-v3.0.2",
"interface-compliance-tests-v7.0.3",
"integration-tests-v1.0.4",
"identify-v4.0.2",
"gossipsub-v15.0.4",
"floodsub-v11.0.3",
"fetch-v4.0.2",
"echo-v3.0.3",
"dcutr-v3.0.2",
"daemon-v6.0.4",
"daemon-server-v9.0.4",
"daemon-client-v10.0.4",
"config-v1.1.17",
"circuit-relay-v2-v4.0.2",
"bootstrap-v12.0.3",
"autonat-v3.0.2",
"autonat-v2-v2.0.2",
"webtransport-v6.0.3",
"websockets-v10.0.2",
"transport-interop-libp2p-main-v1.0.3",
"interop-v14.0.3",
"integration-tests-v1.0.3",
"gossipsub-v15.0.3",
"floodsub-v11.0.2",
"daemon-v6.0.3",
"daemon-server-v9.0.3",
"daemon-client-v10.0.3",
"webtransport-v6.0.2",
"webrtc-v6.0.2",
"transport-interop-libp2p-main-v1.0.2",
"perf-v5.0.2",
"mplex-v12.0.2",
"mdns-v12.0.2",
"libp2p-v3.0.2",
"interop-v14.0.2",
"interface-compliance-tests-v7.0.2",
"integration-tests-v1.0.2",
"gossipsub-v15.0.2",
"echo-v3.0.2",
"daemon-v6.0.2",
"daemon-server-v9.0.2",
"daemon-client-v10.0.2",
"bootstrap-v12.0.2",
"yamux-v8.0.1",
"webtransport-v6.0.1",
"websockets-v10.0.1",
"webrtc-v6.0.1",
"utils-v7.0.1",
"upnp-nat-v4.0.1",
"transport-interop-libp2p-main-v1.0.1",
"tls-v3.0.1",
"tcp-v11.0.1",
"simple-metrics-v2.0.1",
"prometheus-metrics-v5.0.1",
"pnet-v3.0.1",
"plaintext-v3.0.1",
"ping-v3.0.1",
"perf-v5.0.1",
"peer-store-v12.0.1",
"peer-record-v9.0.1",
"peer-id-v6.0.1",
"peer-collections-v7.0.1",
"opentelemetry-metrics-v2.0.1",
"noise-v1.0.1",
"multistream-select-v7.0.1",
"mplex-v12.0.1",
"memory-v2.0.1",
"mdns-v12.0.1",
"logger-v6.0.1",
"libp2p-v3.0.1",
"keychain-v6.0.1",
"kad-dht-v16.0.1",
"interop-v14.0.1",
"interface-internal-v3.0.1",
"interface-compliance-tests-v7.0.1",
"integration-tests-v1.0.1",
"identify-v4.0.1",
"gossipsub-v15.0.1",
"floodsub-v11.0.1",
"fetch-v4.0.1",
"echo-v3.0.1",
"dcutr-v3.0.1",
"daemon-v6.0.1",
"daemon-server-v9.0.1",
"daemon-client-v10.0.1",
"crypto-v5.1.10",
"config-v1.1.16",
"circuit-relay-v2-v4.0.1",
"bootstrap-v12.0.1",
"autonat-v3.0.1",
"autonat-v2-v2.0.1",
"yamux-v8.0.0",
"webtransport-v6.0.0",
"websockets-v10.0.0",
"webrtc-v6.0.0",
"utils-v7.0.0",
"upnp-nat-v4.0.0",
"transport-interop-libp2p-main-v1.0.0",
"tls-v3.0.0",
"tcp-v11.0.0",
"simple-metrics-v2.0.0",
"record-v4.0.8",
"prometheus-metrics-v5.0.0",
"pnet-v3.0.0",
"plaintext-v3.0.0",
"ping-v3.0.0",
"perf-v5.0.0",
"peer-store-v12.0.0",
"peer-record-v9.0.0",
"peer-id-v6.0.0",
"peer-collections-v7.0.0",
"opentelemetry-metrics-v2.0.0",
"noise-v1.0.0",
"multistream-select-v7.0.0",
"mplex-v12.0.0",
"memory-v2.0.0",
"mdns-v12.0.0",
"logger-v6.0.0",
"libp2p-v3.0.0",
"keychain-v6.0.0",
"kad-dht-v16.0.0",
"interop-v14.0.0",
"interface-v3.0.0",
"interface-internal-v3.0.0",
"interface-compliance-tests-v7.0.0",
"integration-tests-v1.0.0",
"identify-v4.0.0",
"gossipsub-v15.0.0",
"floodsub-v11.0.0",
"fetch-v4.0.0",
"echo-v3.0.0",
"dcutr-v3.0.0",
"daemon-v6.0.0",
"daemon-server-v9.0.0",
"daemon-protocol-v8.0.0",
"daemon-client-v10.0.0",
"crypto-v5.1.9",
"config-v1.1.15",
"circuit-relay-v2-v4.0.0",
"bootstrap-v12.0.0",
"autonat-v3.0.0",
"autonat-v2-v2.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86039.json"
}
}
],
"modified": "2026-10-28T02:30:40.534206295Z",
"provider": "osv",
"references": [
"https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86039.json",
"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86039",
"https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30",
"https://github.com/libp2p/js-libp2p/pull/3570"
],
"provider_metadata": {
"cwe_ids": [
"CWE-290",
"CWE-345"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86039.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86039",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508112,
"published_at": "2026-09-17T15:19:00.697+00:00"
}