CVE-2026-77384: LIBP2P Js-LIBP2P

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.

Affected products

• LIBP2P Js-LIBP2P: from 2.1.5, before 4.2.9 (fixed in 4.2.9)

Published 2026-08-24. Last modified 2026-09-09.