CyberRota Analysis
AI-GeneratedThe vulnerability affects the libp2p networking stack in JavaScript, specifically prior to version 16.0.0, where the default settings for maxIhaveMessageIDs and maxIwantMessageIDs were set to Infinity. This flaw allows oversized control message arrays to be processed, potentially blocking the Node.js event loop by synchronously iterating through approximately 180,000 message IDs per 4 MB frame. Developers and organizations using affected versions should prioritize upgrading to version 16.0.0 to mitigate the risk of denial-of-service conditions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.