Memory Exhaustion in libp2p Circuit Relay

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: GitHub, Inc.

Description

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-77384

Affected Vendors & Products

Vendor	Product	Version / Range
libp2p	libp2p	to 4.2.9 (exc)
libp2p	circuit_relay_v2	to 4.2.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the libp2p JavaScript implementation of the libp2p networking stack. It involves a flaw in the reservation refresh path where the same signal is reused without properly managing abort listeners. Repeated valid RESERVE requests cause unbounded listener and closure growth in relay servers, leading to denial of service.

Impact Analysis

If you operate a @libp2p/circuit-relay-v2 relay server using a vulnerable version, an attacker could send repeated RESERVE requests to exhaust server resources. This may cause the server to slow down or crash, disrupting network services for legitimate users.

Mitigation Strategies

Update libp2p to version 4.2.9 or later to address the unbounded listener and closure growth issue in @libp2p/circuit-relay-v2 relay servers.

Hi! I’m here to help you understand CVE-2026-77384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70