{"vulnerability": "cve-2026-49866", "sightings": [{"uuid": "24934b9b-dd23-489f-af48-182e5488af03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49866", "type": "seen", "source": "https://gist.github.com/alon710/9eaabfe8d7f17c883b344ecc760d4947", "content": "# CVE-2026-49866: CVE-2026-49866: CPU-Based Denial of Service in @libp2p/gossipsub Protobuf Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49866\n\n## Summary\nA high-severity denial-of-service vulnerability in @libp2p/gossipsub prior to version 16.0.0 allows unauthenticated remote attackers to trigger event loop starvation and complete node freeze by exploiting unbounded protobuf decoding limits and nested synchronous array iteration loops.\n\n## TL;DR\nUnbounded protobuf limits and synchronous array loops in @libp2p/gossipsub allow unauthenticated remote attackers to block the single-threaded Node.js event loop, causing a complete denial of service.\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5\n- **EPSS Score**: 0.00446\n- **Exploit Status**: poc\n- **KEV Status**: not-listed\n\n## Affected Systems\n\n- @libp2p/gossipsub prior to 16.0.0\n- js-libp2p installations using vulnerable @libp2p/gossipsub modules\n\n## Mitigation\n\n- Upgrade dependency @libp2p/gossipsub to version 16.0.0 or above\n- Configure explicit decodeRpcLimits in GossipSub initialization option block\n- Implement event loop lag monitoring in the application infrastructure\n\n**Remediation Steps:**\n1. Identify vulnerable @libp2p/gossipsub references in package.json or package-lock.json\n2. Execute the upgrade to version 16.0.0 or higher\n3. Alternatively, modify instantiation properties to override default limits manually\n4. Deploy telemetry to capture event loop blocking spikes\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49866) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T16:41:48.965515Z"}, {"uuid": "cf830453-574e-45a3-b136-eaad73d2186a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49866", "type": "published-proof-of-concept", "source": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-cwc9-cp4j-mcvv", "content": "", "creation_timestamp": "2026-07-10T18:35:05.732724Z"}]}