{"uuid": "99635322-2f17-4118-9b6e-7fe483ac1a09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86039", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvqbe7zmh526", "content": "CVE-2026-86039 lets @libp2p/peer-store store attacker-controlled multiaddrs as certified addresses for a victim peer ID because consumePeerRecord does not bind the signer to PeerRecord.peerId. #software", "creation_timestamp": "2026-09-17T18:19:52.220996Z"}