{"metadata": {"vulnerability": "CVE-2026-86039", "count": 14, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-04T19:29:21.058Z", "date_only": false, "value": "2026-09-04T19:29:21.058Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-86039", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-17T15:19:00.697Z", "date_only": false, "value": "2026-09-17T15:19:00.697Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86039", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-17T15:19:00.697Z", "date_only": false, "value": "2026-09-17T15:19:00.697Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-86039", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T16:18:17.090Z", "date_only": false, "value": "2026-09-17T16:18:17.090", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86039", "record": "FKIE_CVE-2026-86039", "field": "published"}, {"timestamp": "2026-09-17T18:01:38Z", "date_only": false, "value": "2026-09-17T18:01:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VRF4-MX87-P53W", "record": "GHSA-VRF4-MX87-P53W", "field": "published"}, {"timestamp": "2026-09-17T18:01:38Z", "date_only": false, "value": "2026-09-17T18:01:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VRF4-MX87-P53W", "record": "GHSA-VRF4-MX87-P53W", "field": "modified"}, {"timestamp": "2026-09-17T18:19:52.220Z", "date_only": false, "value": "2026-09-17T18:19:52.220996Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvqbe7zmh526", "record": "CVE-2026-86039", "field": "creation_timestamp", "uuid": "99635322-2f17-4118-9b6e-7fe483ac1a09", "content": "CVE-2026-86039 lets @libp2p/peer-store store attacker-controlled multiaddrs as certified addresses for a victim peer ID because consumePeerRecord does not bind the signer to PeerRecord.peerId. #software", "url": "https://bsky.app/profile/standup.thecompound.tech/post/3mvqbe7zmh526"}, {"timestamp": "2026-09-17T19:31:30.241Z", "date_only": false, "value": "2026-09-17T19:31:30.241978Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/2a63239df5d54f7447e1b660b93edce2", "record": "CVE-2026-86039", "field": "creation_timestamp", "uuid": "2278034d-57a7-4d4e-a0d7-d9c6132529db", "content": "# CVE-2026-86039: CVE-2026-86039: Signature Verification Bypass and Address Book Poisoning in @libp2p/peer-store\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86039\n\n## Summary\nA logic verification vulnerability in `@libp2p/peer-store` (part of the `js-libp2p` ecosystem) allows unauthenticated remote attackers to bypass identity verification and poison a victim node's peer store database with arbitrary network multiaddresses. This occurs because `consumePeerRecord()` fails to ensure that the signature's identity matches the inner record payload's identity.\n\n## TL;DR\nThe `consumePeerRecord()` function verifies the signature of a wrapping envelope but does not validate that the signer's identity equals the peer ID specified inside the payload, allowing attackers to poison address stores of network nodes.\n\n## Technical Details\n\n- **CWE ID**: CWE-290 / CWE-345\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: Integrity (High), Availability (Low)\n- **Exploit Status**: None (No public PoC)\n- **KEV Status**: Not in CISA KEV\n\n## Affected Systems\n\n- js-libp2p ecosystem applications\n- libp2p-based decentralized nodes\n- @libp2p/peer-store users\n- **@libp2p/peer-store**: >= 8.0.0 < 12.0.24 (Fixed in: `12.0.24`)\n\n## Mitigation\n\n- Upgrade @libp2p/peer-store to 12.0.24 or higher\n- Implement logging and alerting on mismatch warnings\n- Disable Gossipsub PX if not strictly required in trusted environments\n\n**Remediation Steps:**\n1. Analyze the project dependency tree to locate vulnerable versions of @libp2p/peer-store (< 12.0.24).\n2. Update the manifest file (package.json) to declare @libp2p/peer-store v12.0.24 or higher.\n3. Rebuild the dependency lockfile (package-lock.json or yarn.lock) and deploy the updated application.\n4. Configure log analysis rules to monitor for the 'signing key did not match peer id' signature.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrf4-mx87-p53w](https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86039) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/2a63239df5d54f7447e1b660b93edce2"}, {"timestamp": "2026-09-17T20:35:02.494Z", "date_only": false, "value": "2026-09-17T20:35:02.494981Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w", "record": "CVE-2026-86039", "field": "creation_timestamp", "uuid": "a98046a5-7268-43d8-9bde-f9133a9751e9", "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w"}, {"timestamp": "2026-09-21T20:48:30.538Z", "date_only": false, "value": "2026-09-21T20:48:30.538605Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-86039", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-21T20:48:30.538Z", "date_only": false, "value": "2026-09-21T20:48:30.538605Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86039", "record": "FKIE_CVE-2026-86039", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-21T20:48:54.323Z", "date_only": false, "value": "2026-09-21T20:48:54.323Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-86039", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-21T20:48:54.323Z", "date_only": false, "value": "2026-09-21T20:48:54.323Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-86039", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T21:19:05.340Z", "date_only": false, "value": "2026-09-24T21:19:05.340", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86039", "record": "FKIE_CVE-2026-86039", "field": "lastModified"}]}