{"uuid": "20ffbf73-4fe2-4b7f-9ecf-859d3fe5127a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vrf4-mx87-p53w", "type": "seen", "source": "https://gist.github.com/alon710/2a63239df5d54f7447e1b660b93edce2", "content": "# CVE-2026-86039: CVE-2026-86039: Signature Verification Bypass and Address Book Poisoning in @libp2p/peer-store\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86039\n\n## Summary\nA logic verification vulnerability in `@libp2p/peer-store` (part of the `js-libp2p` ecosystem) allows unauthenticated remote attackers to bypass identity verification and poison a victim node's peer store database with arbitrary network multiaddresses. This occurs because `consumePeerRecord()` fails to ensure that the signature's identity matches the inner record payload's identity.\n\n## TL;DR\nThe `consumePeerRecord()` function verifies the signature of a wrapping envelope but does not validate that the signer's identity equals the peer ID specified inside the payload, allowing attackers to poison address stores of network nodes.\n\n## Technical Details\n\n- **CWE ID**: CWE-290 / CWE-345\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: Integrity (High), Availability (Low)\n- **Exploit Status**: None (No public PoC)\n- **KEV Status**: Not in CISA KEV\n\n## Affected Systems\n\n- js-libp2p ecosystem applications\n- libp2p-based decentralized nodes\n- @libp2p/peer-store users\n- **@libp2p/peer-store**: >= 8.0.0 < 12.0.24 (Fixed in: `12.0.24`)\n\n## Mitigation\n\n- Upgrade @libp2p/peer-store to 12.0.24 or higher\n- Implement logging and alerting on mismatch warnings\n- Disable Gossipsub PX if not strictly required in trusted environments\n\n**Remediation Steps:**\n1. Analyze the project dependency tree to locate vulnerable versions of @libp2p/peer-store (< 12.0.24).\n2. Update the manifest file (package.json) to declare @libp2p/peer-store v12.0.24 or higher.\n3. Rebuild the dependency lockfile (package-lock.json or yarn.lock) and deploy the updated application.\n4. Configure log analysis rules to monitor for the 'signing key did not match peer id' signature.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrf4-mx87-p53w](https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86039) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T19:31:30.205312Z"}