CVE-2026-77384

Deferred Deferred - Pending Action

Memory Exhaustion in libp2p Circuit Relay

Publication date: 2026-08-24

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-09-09

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-13

NVD

CVE-2026-77384

Affected Vendors & Products

Vendor	Product	Version / Range
libp2p	libp2p	to 4.2.9 (exc)
libp2p	circuit_relay_v2	to 4.2.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the libp2p JavaScript implementation of the libp2p networking stack. It involves a flaw in the reservation refresh path where the same signal is reused without properly managing abort listeners. Repeated valid RESERVE requests cause unbounded listener and closure growth in relay servers, leading to denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers. Check for excessive RESERVE requests from the same remote peer causing memory or resource exhaustion. Use system monitoring tools to track process memory usage and open file descriptors.

Impact Analysis

If you operate a @libp2p/circuit-relay-v2 relay server using a vulnerable version, an attacker could send repeated RESERVE requests to exhaust server resources. This may cause the server to slow down or crash, disrupting network services for legitimate users.

Compliance Impact

This vulnerability causes denial of service by exhausting server resources through unbounded listener and closure growth. While not directly related to data protection, such disruptions could impact availability requirements under GDPR and HIPAA, potentially leading to compliance violations if critical systems become unavailable.

Mitigation Strategies

Update libp2p to version 4.2.9 or later to address the unbounded listener and closure growth issue in @libp2p/circuit-relay-v2 relay servers.

Hi! I’m here to help you understand CVE-2026-77384. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70