https://vulnerability.circl.lu/sightings/feed 2026-09-20T06:44:46.497146+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a98046a5-7268-43d8-9bde-f9133a9751e9/export 2026-09-20T06:44:46.523529+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "a98046a5-7268-43d8-9bde-f9133a9751e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86039", "type": "published-proof-of-concept", "source": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w", "content": "", "creation_timestamp": "2026-09-17T20:35:02.494981Z"} 2026-09-17T20:35:02.494981+00:00 https://vulnerability.circl.lu/sighting/2278034d-57a7-4d4e-a0d7-d9c6132529db/export 2026-09-20T06:44:46.526389+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2278034d-57a7-4d4e-a0d7-d9c6132529db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86039", "type": "seen", "source": "https://gist.github.com/alon710/2a63239df5d54f7447e1b660b93edce2", "content": "# CVE-2026-86039: CVE-2026-86039: Signature Verification Bypass and Address Book Poisoning in @libp2p/peer-store\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86039\n\n## Summary\nA logic verification vulnerability in `@libp2p/peer-store` (part of the `js-libp2p` ecosystem) allows unauthenticated remote attackers to bypass identity verification and poison a victim node's peer store database with arbitrary network multiaddresses. This occurs because `consumePeerRecord()` fails to ensure that the signature's identity matches the inner record payload's identity.\n\n## TL;DR\nThe `consumePeerRecord()` function verifies the signature of a wrapping envelope but does not validate that the signer's identity equals the peer ID specified inside the payload, allowing attackers to poison address stores of network nodes.\n\n## Technical Details\n\n- **CWE ID**: CWE-290 / CWE-345\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: Integrity (High), Availability (Low)\n- **Exploit Status**: None (No public PoC)\n- **KEV Status**: Not in CISA KEV\n\n## Affected Systems\n\n- js-libp2p ecosystem applications\n- libp2p-based decentralized nodes\n- @libp2p/peer-store users\n- **@libp2p/peer-store**: >= 8.0.0 < 12.0.24 (Fixed in: `12.0.24`)\n\n## Mitigation\n\n- Upgrade @libp2p/peer-store to 12.0.24 or higher\n- Implement logging and alerting on mismatch warnings\n- Disable Gossipsub PX if not strictly required in trusted environments\n\n**Remediation Steps:**\n1. Analyze the project dependency tree to locate vulnerable versions of @libp2p/peer-store (< 12.0.24).\n2. Update the manifest file (package.json) to declare @libp2p/peer-store v12.0.24 or higher.\n3. Rebuild the dependency lockfile (package-lock.json or yarn.lock) and deploy the updated application.\n4. Configure log analysis rules to monitor for the 'signing key did not match peer id' signature.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrf4-mx87-p53w](https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86039) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T19:31:30.241978Z"} 2026-09-17T19:31:30.241978+00:00 https://vulnerability.circl.lu/sighting/99635322-2f17-4118-9b6e-7fe483ac1a09/export 2026-09-20T06:44:46.551021+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "99635322-2f17-4118-9b6e-7fe483ac1a09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86039", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvqbe7zmh526", "content": "CVE-2026-86039 lets @libp2p/peer-store store attacker-controlled multiaddrs as certified addresses for a victim peer ID because consumePeerRecord does not bind the signer to PeerRecord.peerId. #software", "creation_timestamp": "2026-09-17T18:19:52.220996Z"} 2026-09-17T18:19:52.220996+00:00