libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwantMessageIDs to Infinity, allowing oversized IHAVE and IWANT control message arrays in message/decodeRpc.ts and gossipsub.ts to synchronously iterate roughly 180,000 message IDs per 4 MB frame and block the Node.js event loop. This issue is fixed in version 16.0.0.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-770"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49866.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "16.0.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "773dd80ded24dbd6b19e675c89fd2f3b45f2d899"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "gossipsub-v16.0.0",
"range": [
{
"fixed": "08eb47154168f894a0b4847dcf4f42ff52e8420e"
}
],
"source": "REFERENCES_TAG"
}
]
}