CVE-2026-77384

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77384
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77384.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77384
Aliases
  • GHSA-x787-gh7p-hmq7
Published
2026-08-24T21:06:39Z
Modified
2026-10-28T02:30:28Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
Details

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400",
        "CWE-772"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77384.json"
}
References

Affected packages

Git / github.com/libp2p/js-libp2p

Affected ranges

Type
GIT
Repo
https://github.com/libp2p/js-libp2p
Events
Introduced
52ac5236b2528237c8c7992b32e9a8b7e0208845
Fixed
92f9acbc1d2aa7b1bb5a8e460e4e0b5770f4455c
Fixed
4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d
Fixed
cf0dbb38a2bc86e4346660c804a873fefbbeab49
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.1.5"
                },
                {
                    "fixed":  "4.2.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "circuit-relay-v2-v4.2.9",
            "range":  [
                {
                    "fixed":  "cf0dbb38a2bc86e4346660c804a873fefbbeab49"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

auto-tls-v1.*
auto-tls-v1.0.0
autonat-v1.*
autonat-v1.1.5
autonat-v2.*
autonat-v2.0.0
autonat-v2.0.1
autonat-v2.0.10
autonat-v2.0.11
autonat-v2.0.12
autonat-v2.0.13
autonat-v2.0.2
autonat-v2.0.3
autonat-v2.0.4
autonat-v2.0.5
autonat-v2.0.6
autonat-v2.0.7
autonat-v2.0.8
autonat-v2.0.9
bootstrap-v10.*
bootstrap-v10.1.5
bootstrap-v11.*
bootstrap-v11.0.0
bootstrap-v11.0.1
bootstrap-v11.0.10
bootstrap-v11.0.11
bootstrap-v11.0.12
bootstrap-v11.0.13
bootstrap-v11.0.14
bootstrap-v11.0.2
bootstrap-v11.0.3
bootstrap-v11.0.4
bootstrap-v11.0.5
bootstrap-v11.0.6
bootstrap-v11.0.7
bootstrap-v11.0.8
bootstrap-v11.0.9
circuit-relay-v2-v1.*
circuit-relay-v2-v1.1.5
circuit-relay-v2-v2.*
circuit-relay-v2-v2.0.0
circuit-relay-v2-v2.0.1
circuit-relay-v2-v2.0.2
circuit-relay-v2-v2.0.3
circuit-relay-v2-v2.0.4
circuit-relay-v2-v2.1.0
circuit-relay-v2-v2.1.1
circuit-relay-v2-v2.1.2
circuit-relay-v2-v2.1.3
circuit-relay-v2-v2.1.4
circuit-relay-v2-v2.1.5
circuit-relay-v2-v3.*
circuit-relay-v2-v3.0.0
circuit-relay-v2-v3.1.0
circuit-relay-v2-v3.1.1
circuit-relay-v2-v3.1.2
circuit-relay-v2-v3.1.3
circuit-relay-v2-v3.1.4
crypto-v4.*
crypto-v4.1.9
crypto-v5.*
crypto-v5.0.0
crypto-v5.0.1
crypto-v5.0.2
crypto-v5.0.3
crypto-v5.0.4
crypto-v5.0.5
crypto-v5.0.6
crypto-v5.0.7
crypto-v5.0.8
dcutr-v1.*
dcutr-v1.1.5
dcutr-v2.*
dcutr-v2.0.0
dcutr-v2.0.1
dcutr-v2.0.10
dcutr-v2.0.11
dcutr-v2.0.12
dcutr-v2.0.13
dcutr-v2.0.2
dcutr-v2.0.3
dcutr-v2.0.4
dcutr-v2.0.5
dcutr-v2.0.6
dcutr-v2.0.7
dcutr-v2.0.8
dcutr-v2.0.9
devtools-metrics-v0.*
devtools-metrics-v0.2.5
devtools-metrics-v1.*
devtools-metrics-v1.0.0
devtools-metrics-v1.0.1
devtools-metrics-v1.1.0
devtools-metrics-v1.1.1
devtools-metrics-v1.1.10
devtools-metrics-v1.1.11
devtools-metrics-v1.1.2
devtools-metrics-v1.1.3
devtools-metrics-v1.1.4
devtools-metrics-v1.1.5
devtools-metrics-v1.1.6
devtools-metrics-v1.1.7
devtools-metrics-v1.1.8
devtools-metrics-v1.1.9
echo-v1.*
echo-v1.1.5
echo-v2.*
echo-v2.0.0
echo-v2.0.1
echo-v2.0.2
echo-v2.0.3
echo-v2.0.4
echo-v2.0.5
echo-v2.0.6
echo-v2.0.7
echo-v2.0.8
echo-v2.1.0
echo-v2.1.1
echo-v2.1.2
echo-v2.1.3
echo-v2.1.4
fetch-v1.*
fetch-v1.1.5
fetch-v2.*
fetch-v2.0.0
fetch-v2.0.1
fetch-v2.0.10
fetch-v2.0.11
fetch-v2.0.12
fetch-v2.0.13
fetch-v2.0.2
fetch-v2.0.3
fetch-v2.0.4
fetch-v2.0.5
fetch-v2.0.6
fetch-v2.0.7
fetch-v2.0.8
fetch-v2.0.9
floodsub-v10.*
floodsub-v10.0.0
floodsub-v10.0.1
floodsub-v10.1.0
floodsub-v10.1.1
floodsub-v10.1.10
floodsub-v10.1.11
floodsub-v10.1.12
floodsub-v10.1.2
floodsub-v10.1.3
floodsub-v10.1.4
floodsub-v10.1.5
floodsub-v10.1.6
floodsub-v10.1.7
floodsub-v10.1.8
floodsub-v10.1.9
floodsub-v9.*
floodsub-v9.1.5
identify-v2.*
identify-v2.1.5
identify-v3.*
identify-v3.0.0
identify-v3.0.1
identify-v3.0.10
identify-v3.0.11
identify-v3.0.12
identify-v3.0.13
identify-v3.0.2
identify-v3.0.3
identify-v3.0.4
identify-v3.0.5
identify-v3.0.6
identify-v3.0.7
identify-v3.0.8
identify-v3.0.9
interface-compliance-tests-v5.*
interface-compliance-tests-v5.4.12
interface-compliance-tests-v6.*
interface-compliance-tests-v6.0.0
interface-compliance-tests-v6.0.1
interface-compliance-tests-v6.1.0
interface-compliance-tests-v6.1.1
interface-compliance-tests-v6.1.10
interface-compliance-tests-v6.1.11
interface-compliance-tests-v6.1.2
interface-compliance-tests-v6.1.3
interface-compliance-tests-v6.1.4
interface-compliance-tests-v6.1.5
interface-compliance-tests-v6.1.6
interface-compliance-tests-v6.1.7
interface-compliance-tests-v6.1.8
interface-compliance-tests-v6.1.9
interface-compliance-tests-v6.2.0
interface-internal-v1.*
interface-internal-v1.3.4
interface-internal-v2.*
interface-internal-v2.0.0
interface-internal-v2.0.1
interface-internal-v2.0.10
interface-internal-v2.0.2
interface-internal-v2.0.3
interface-internal-v2.0.4
interface-internal-v2.0.5
interface-internal-v2.0.6
interface-internal-v2.0.7
interface-internal-v2.0.8
interface-internal-v2.0.9
interface-internal-v2.1.0
interface-internal-v2.1.1
interface-internal-v2.2.0
interface-v1.*
interface-v1.7.0
interface-v2.*
interface-v2.0.0
interface-v2.0.1
interface-v2.1.0
interface-v2.1.1
interface-v2.1.2
interface-v2.1.3
interface-v2.2.0
interface-v2.2.1
interface-v2.3.0
kad-dht-v12.*
kad-dht-v12.1.5
kad-dht-v13.*
kad-dht-v13.0.0
kad-dht-v13.0.1
kad-dht-v13.0.2
kad-dht-v13.0.3
kad-dht-v13.0.4
kad-dht-v13.1.0
kad-dht-v13.1.1
kad-dht-v13.1.2
kad-dht-v14.*
kad-dht-v14.0.0
kad-dht-v14.0.1
kad-dht-v14.0.2
kad-dht-v14.1.0
kad-dht-v14.1.1
kad-dht-v14.1.2
kad-dht-v14.1.3
kad-dht-v14.1.4
keychain-v4.*
keychain-v4.1.5
keychain-v4.1.6
keychain-v5.*
keychain-v5.0.0
keychain-v5.0.1
keychain-v5.0.10
keychain-v5.0.11
keychain-v5.0.2
keychain-v5.0.3
keychain-v5.0.4
keychain-v5.0.5
keychain-v5.0.6
keychain-v5.0.7
keychain-v5.0.8
keychain-v5.0.9
libp2p-v1.*
libp2p-v1.9.0
libp2p-v1.9.1
libp2p-v1.9.2
libp2p-v1.9.3
libp2p-v1.9.4
libp2p-v2.*
libp2p-v2.0.0
libp2p-v2.0.1
libp2p-v2.0.2
libp2p-v2.0.3
libp2p-v2.1.0
libp2p-v2.1.1
libp2p-v2.1.10
libp2p-v2.1.2
libp2p-v2.1.3
libp2p-v2.1.4
libp2p-v2.1.5
libp2p-v2.1.6
libp2p-v2.1.7
libp2p-v2.1.8
libp2p-v2.1.9
libp2p-v2.2.0
libp2p-v2.2.1
libp2p-v2.3.0
libp2p-v2.3.1
libp2p-v2.4.0
logger-v4.*
logger-v4.0.20
logger-v5.*
logger-v5.0.0
logger-v5.0.1
logger-v5.0.2
logger-v5.0.3
logger-v5.0.4
logger-v5.1.0
logger-v5.1.1
logger-v5.1.2
logger-v5.1.3
logger-v5.1.4
logger-v5.1.5
mdns-v10.*
mdns-v10.1.5
mdns-v11.*
mdns-v11.0.0
mdns-v11.0.1
mdns-v11.0.10
mdns-v11.0.11
mdns-v11.0.12
mdns-v11.0.13
mdns-v11.0.14
mdns-v11.0.2
mdns-v11.0.3
mdns-v11.0.4
mdns-v11.0.5
mdns-v11.0.6
mdns-v11.0.7
mdns-v11.0.8
mdns-v11.0.9
memory-v1.*
memory-v1.0.0
memory-v1.0.1
memory-v1.0.2
mplex-v10.*
mplex-v10.1.5
mplex-v11.*
mplex-v11.0.0
mplex-v11.0.1
mplex-v11.0.10
mplex-v11.0.11
mplex-v11.0.12
mplex-v11.0.13
mplex-v11.0.14
mplex-v11.0.2
mplex-v11.0.3
mplex-v11.0.4
mplex-v11.0.5
mplex-v11.0.6
mplex-v11.0.7
mplex-v11.0.8
mplex-v11.0.9
multistream-select-v5.*
multistream-select-v5.1.17
multistream-select-v6.*
multistream-select-v6.0.0
multistream-select-v6.0.1
multistream-select-v6.0.10
multistream-select-v6.0.2
multistream-select-v6.0.3
multistream-select-v6.0.4
multistream-select-v6.0.5
multistream-select-v6.0.6
multistream-select-v6.0.7
multistream-select-v6.0.8
multistream-select-v6.0.9
peer-collections-v5.*
peer-collections-v5.2.9
peer-collections-v6.*
peer-collections-v6.0.0
peer-collections-v6.0.1
peer-collections-v6.0.10
peer-collections-v6.0.11
peer-collections-v6.0.12
peer-collections-v6.0.13
peer-collections-v6.0.2
peer-collections-v6.0.3
peer-collections-v6.0.4
peer-collections-v6.0.5
peer-collections-v6.0.6
peer-collections-v6.0.7
peer-collections-v6.0.8
peer-collections-v6.0.9
peer-id-factory-v4.*
peer-id-factory-v4.2.4
peer-id-v4.*
peer-id-v4.2.4
peer-id-v5.*
peer-id-v5.0.0
peer-id-v5.0.1
peer-id-v5.0.2
peer-id-v5.0.3
peer-id-v5.0.4
peer-id-v5.0.5
peer-id-v5.0.6
peer-id-v5.0.7
peer-id-v5.0.8
peer-id-v5.0.9
peer-record-v7.*
peer-record-v7.0.25
peer-record-v8.*
peer-record-v8.0.0
peer-record-v8.0.1
peer-record-v8.0.10
peer-record-v8.0.11
peer-record-v8.0.12
peer-record-v8.0.13
peer-record-v8.0.2
peer-record-v8.0.3
peer-record-v8.0.4
peer-record-v8.0.5
peer-record-v8.0.6
peer-record-v8.0.7
peer-record-v8.0.8
peer-record-v8.0.9
peer-store-v10.*
peer-store-v10.1.5
peer-store-v11.*
peer-store-v11.0.0
peer-store-v11.0.1
peer-store-v11.0.10
peer-store-v11.0.11
peer-store-v11.0.12
peer-store-v11.0.13
peer-store-v11.0.2
peer-store-v11.0.3
peer-store-v11.0.4
peer-store-v11.0.5
peer-store-v11.0.6
peer-store-v11.0.7
peer-store-v11.0.8
peer-store-v11.0.9
perf-v3.*
perf-v3.1.5
perf-v4.*
perf-v4.0.0
perf-v4.0.1
perf-v4.0.10
perf-v4.0.11
perf-v4.0.12
perf-v4.0.13
perf-v4.0.14
perf-v4.0.2
perf-v4.0.3
perf-v4.0.4
perf-v4.0.5
perf-v4.0.6
perf-v4.0.7
perf-v4.0.8
perf-v4.0.9
ping-v1.*
ping-v1.1.5
ping-v1.1.6
ping-v2.*
ping-v2.0.0
ping-v2.0.1
ping-v2.0.10
ping-v2.0.11
ping-v2.0.12
ping-v2.0.13
ping-v2.0.2
ping-v2.0.3
ping-v2.0.4
ping-v2.0.5
ping-v2.0.6
ping-v2.0.7
ping-v2.0.8
ping-v2.0.9
plaintext-v1.*
plaintext-v1.1.5
plaintext-v1.1.6
plaintext-v2.*
plaintext-v2.0.0
plaintext-v2.0.1
plaintext-v2.0.10
plaintext-v2.0.11
plaintext-v2.0.12
plaintext-v2.0.2
plaintext-v2.0.3
plaintext-v2.0.4
plaintext-v2.0.5
plaintext-v2.0.6
plaintext-v2.0.7
plaintext-v2.0.8
plaintext-v2.0.9
pnet-v2.*
pnet-v2.0.0
pnet-v2.0.1
pnet-v2.0.10
pnet-v2.0.11
pnet-v2.0.12
pnet-v2.0.13
pnet-v2.0.14
pnet-v2.0.2
pnet-v2.0.3
pnet-v2.0.4
pnet-v2.0.5
pnet-v2.0.6
pnet-v2.0.7
pnet-v2.0.8
pnet-v2.0.9
prometheus-metrics-v3.*
prometheus-metrics-v3.1.5
prometheus-metrics-v4.*
prometheus-metrics-v4.0.0
prometheus-metrics-v4.0.1
prometheus-metrics-v4.1.0
prometheus-metrics-v4.1.1
prometheus-metrics-v4.1.2
prometheus-metrics-v4.1.3
prometheus-metrics-v4.2.0
prometheus-metrics-v4.2.1
prometheus-metrics-v4.2.2
prometheus-metrics-v4.2.3
prometheus-metrics-v4.2.4
prometheus-metrics-v4.2.5
prometheus-metrics-v4.2.6
prometheus-metrics-v4.2.7
prometheus-metrics-v4.2.8
pubsub-v10.*
pubsub-v10.0.0
pubsub-v10.0.1
pubsub-v10.0.10
pubsub-v10.0.11
pubsub-v10.0.12
pubsub-v10.0.13
pubsub-v10.0.2
pubsub-v10.0.3
pubsub-v10.0.4
pubsub-v10.0.5
pubsub-v10.0.6
pubsub-v10.0.7
pubsub-v10.0.8
pubsub-v10.0.9
pubsub-v9.*
pubsub-v9.0.26
simple-metrics-v1.*
simple-metrics-v1.1.5
simple-metrics-v1.1.6
simple-metrics-v1.1.7
simple-metrics-v1.2.0
simple-metrics-v1.2.1
simple-metrics-v1.2.2
simple-metrics-v1.2.3
simple-metrics-v1.2.4
simple-metrics-v1.2.5
simple-metrics-v1.2.6
simple-metrics-v1.2.7
simple-metrics-v1.2.8
tcp-v10.*
tcp-v10.0.0
tcp-v10.0.1
tcp-v10.0.10
tcp-v10.0.11
tcp-v10.0.12
tcp-v10.0.13
tcp-v10.0.14
tcp-v10.0.2
tcp-v10.0.3
tcp-v10.0.4
tcp-v10.0.5
tcp-v10.0.6
tcp-v10.0.7
tcp-v10.0.8
tcp-v10.0.9
tcp-v9.*
tcp-v9.1.5
tcp-v9.1.6
tls-v1.*
tls-v1.1.5
tls-v2.*
tls-v2.0.0
tls-v2.0.1
tls-v2.0.10
tls-v2.0.11
tls-v2.0.12
tls-v2.0.2
tls-v2.0.3
tls-v2.0.4
tls-v2.0.5
tls-v2.0.6
tls-v2.0.7
tls-v2.0.8
tls-v2.0.9
upnp-nat-v1.*
upnp-nat-v1.2.5
upnp-nat-v2.*
upnp-nat-v2.0.0
upnp-nat-v2.0.1
upnp-nat-v2.0.10
upnp-nat-v2.0.11
upnp-nat-v2.0.12
upnp-nat-v2.0.2
upnp-nat-v2.0.3
upnp-nat-v2.0.4
upnp-nat-v2.0.5
upnp-nat-v2.0.6
upnp-nat-v2.0.7
upnp-nat-v2.0.8
upnp-nat-v2.0.9
upnp-nat-v3.*
upnp-nat-v3.0.0
upnp-nat-v3.0.1
utils-v5.*
utils-v5.4.9
utils-v6.*
utils-v6.0.0
utils-v6.0.1
utils-v6.0.2
utils-v6.0.3
utils-v6.0.4
utils-v6.0.5
utils-v6.0.6
utils-v6.1.0
utils-v6.1.1
utils-v6.1.2
utils-v6.1.3
utils-v6.2.0
utils-v6.2.1
utils-v6.3.0
webrtc-v4.*
webrtc-v4.1.10
webrtc-v4.1.5
webrtc-v4.1.6
webrtc-v4.1.7
webrtc-v4.1.8
webrtc-v4.1.9
webrtc-v5.*
webrtc-v5.0.0
webrtc-v5.0.1
webrtc-v5.0.10
webrtc-v5.0.11
webrtc-v5.0.12
webrtc-v5.0.13
webrtc-v5.0.14
webrtc-v5.0.15
webrtc-v5.0.16
webrtc-v5.0.17
webrtc-v5.0.18
webrtc-v5.0.19
webrtc-v5.0.2
webrtc-v5.0.20
webrtc-v5.0.3
webrtc-v5.0.4
webrtc-v5.0.5
webrtc-v5.0.6
webrtc-v5.0.7
webrtc-v5.0.8
webrtc-v5.0.9
websockets-v8.*
websockets-v8.2.0
websockets-v9.*
websockets-v9.0.0
websockets-v9.0.1
websockets-v9.0.10
websockets-v9.0.11
websockets-v9.0.12
websockets-v9.0.13
websockets-v9.0.2
websockets-v9.0.3
websockets-v9.0.4
websockets-v9.0.5
websockets-v9.0.6
websockets-v9.0.7
websockets-v9.0.8
websockets-v9.0.9
websockets-v9.1.0
webtransport-v4.*
webtransport-v4.1.5
webtransport-v4.1.6
webtransport-v4.1.7
webtransport-v4.1.8
webtransport-v4.1.9
webtransport-v5.*
webtransport-v5.0.0
webtransport-v5.0.1
webtransport-v5.0.10
webtransport-v5.0.11
webtransport-v5.0.12
webtransport-v5.0.13
webtransport-v5.0.14
webtransport-v5.0.15
webtransport-v5.0.16
webtransport-v5.0.17
webtransport-v5.0.18
webtransport-v5.0.19
webtransport-v5.0.2
webtransport-v5.0.3
webtransport-v5.0.4
webtransport-v5.0.5
webtransport-v5.0.6
webtransport-v5.0.7
webtransport-v5.0.8
webtransport-v5.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77384.json"