{"id":"CVE-2026-77384","summary":"libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion","details":"libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.","aliases":["GHSA-x787-gh7p-hmq7"],"modified":"2026-10-28T02:30:28.808762701Z","published":"2026-08-24T21:06:39.909Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77384.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-772"]},"references":[{"type":"WEB","url":"https://github.com/libp2p/js-libp2p/releases/tag/circuit-relay-v2-v4.2.9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77384.json"},{"type":"ADVISORY","url":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-x787-gh7p-hmq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77384"},{"type":"FIX","url":"https://github.com/libp2p/js-libp2p/commit/4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libp2p/js-libp2p","events":[{"introduced":"52ac5236b2528237c8c7992b32e9a8b7e0208845"},{"fixed":"92f9acbc1d2aa7b1bb5a8e460e4e0b5770f4455c"},{"fixed":"4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d"},{"fixed":"cf0dbb38a2bc86e4346660c804a873fefbbeab49"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"2.1.5"},{"fixed":"4.2.9"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"4bb8fbe8d3f3590e4af51a1f5f7de56fffa5804d"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"circuit-relay-v2-v4.2.9","range":[{"fixed":"cf0dbb38a2bc86e4346660c804a873fefbbeab49"}]}]}}],"versions":["upnp-nat-v3.0.1","webtransport-v5.0.19","websockets-v9.1.0","webrtc-v5.0.20","utils-v6.3.0","upnp-nat-v3.0.0","tls-v2.0.12","tcp-v10.0.14","simple-metrics-v1.2.8","pubsub-v10.0.13","prometheus-metrics-v4.2.8","pnet-v2.0.14","plaintext-v2.0.12","ping-v2.0.13","perf-v4.0.14","peer-store-v11.0.13","peer-record-v8.0.13","peer-id-v5.0.9","peer-collections-v6.0.13","multistream-select-v6.0.10","mplex-v11.0.14","memory-v1.0.2","mdns-v11.0.14","logger-v5.1.5","libp2p-v2.4.0","keychain-v5.0.11","kad-dht-v14.1.4","interface-v2.3.0","interface-internal-v2.2.0","interface-compliance-tests-v6.2.0","identify-v3.0.13","floodsub-v10.1.12","fetch-v2.0.13","echo-v2.1.4","devtools-metrics-v1.1.11","dcutr-v2.0.13","crypto-v5.0.8","circuit-relay-v2-v3.1.4","bootstrap-v11.0.14","autonat-v2.0.13","auto-tls-v1.0.0","webrtc-v5.0.19","prometheus-metrics-v4.2.7","pnet-v2.0.13","perf-v4.0.13","mplex-v11.0.13","mdns-v11.0.13","kad-dht-v14.1.3","interface-compliance-tests-v6.1.11","floodsub-v10.1.11","circuit-relay-v2-v3.1.3","bootstrap-v11.0.13","webtransport-v5.0.18","websockets-v9.0.13","webrtc-v5.0.18","utils-v6.2.1","upnp-nat-v2.0.12","tls-v2.0.11","tcp-v10.0.13","simple-metrics-v1.2.7","pubsub-v10.0.12","prometheus-metrics-v4.2.6","pnet-v2.0.12","plaintext-v2.0.11","ping-v2.0.12","perf-v4.0.12","peer-store-v11.0.12","peer-record-v8.0.12","peer-id-v5.0.8","peer-collections-v6.0.12","multistream-select-v6.0.9","mplex-v11.0.12","memory-v1.0.1","mdns-v11.0.12","logger-v5.1.4","libp2p-v2.3.1","keychain-v5.0.10","kad-dht-v14.1.2","interface-v2.2.1","interface-internal-v2.1.1","interface-compliance-tests-v6.1.10","identify-v3.0.12","floodsub-v10.1.10","fetch-v2.0.12","echo-v2.1.3","devtools-metrics-v1.1.10","dcutr-v2.0.12","crypto-v5.0.7","circuit-relay-v2-v3.1.2","bootstrap-v11.0.12","autonat-v2.0.12","webtransport-v5.0.17","websockets-v9.0.12","webrtc-v5.0.17","utils-v6.2.0","upnp-nat-v2.0.11","tcp-v10.0.12","pubsub-v10.0.11","prometheus-metrics-v4.2.5","pnet-v2.0.11","ping-v2.0.11","perf-v4.0.11","peer-store-v11.0.11","peer-record-v8.0.11","peer-collections-v6.0.11","mplex-v11.0.11","memory-v1.0.0","mdns-v11.0.11","libp2p-v2.3.0","kad-dht-v14.1.1","interface-internal-v2.1.0","interface-compliance-tests-v6.1.9","identify-v3.0.11","floodsub-v10.1.9","fetch-v2.0.11","echo-v2.1.2","devtools-metrics-v1.1.9","dcutr-v2.0.11","circuit-relay-v2-v3.1.1","bootstrap-v11.0.11","autonat-v2.0.11","webtransport-v5.0.16","websockets-v9.0.11","webrtc-v5.0.16","libp2p-v2.2.1","webtransport-v5.0.15","websockets-v9.0.10","webrtc-v5.0.15","utils-v6.1.3","upnp-nat-v2.0.10","tls-v2.0.10","tcp-v10.0.11","simple-metrics-v1.2.6","pubsub-v10.0.10","prometheus-metrics-v4.2.4","pnet-v2.0.10","plaintext-v2.0.10","ping-v2.0.10","perf-v4.0.10","peer-store-v11.0.10","peer-record-v8.0.10","peer-id-v5.0.7","peer-collections-v6.0.10","multistream-select-v6.0.8","mplex-v11.0.10","mdns-v11.0.10","logger-v5.1.3","libp2p-v2.2.0","keychain-v5.0.9","kad-dht-v14.1.0","interface-v2.2.0","interface-internal-v2.0.10","interface-compliance-tests-v6.1.8","identify-v3.0.10","floodsub-v10.1.8","fetch-v2.0.10","echo-v2.1.1","devtools-metrics-v1.1.8","dcutr-v2.0.10","crypto-v5.0.6","circuit-relay-v2-v3.1.0","bootstrap-v11.0.10","autonat-v2.0.10","webtransport-v5.0.14","websockets-v9.0.9","webrtc-v5.0.14","utils-v6.1.2","upnp-nat-v2.0.9","tls-v2.0.9","tcp-v10.0.10","simple-metrics-v1.2.5","pubsub-v10.0.9","prometheus-metrics-v4.2.3","pnet-v2.0.9","plaintext-v2.0.9","ping-v2.0.9","perf-v4.0.9","peer-store-v11.0.9","peer-record-v8.0.9","peer-id-v5.0.6","peer-collections-v6.0.9","multistream-select-v6.0.7","mplex-v11.0.9","mdns-v11.0.9","logger-v5.1.2","libp2p-v2.1.10","keychain-v5.0.8","kad-dht-v14.0.2","interface-internal-v2.0.9","interface-compliance-tests-v6.1.7","identify-v3.0.9","floodsub-v10.1.7","fetch-v2.0.9","echo-v2.1.0","devtools-metrics-v1.1.7","dcutr-v2.0.9","circuit-relay-v2-v3.0.0","bootstrap-v11.0.9","autonat-v2.0.9","webtransport-v5.0.13","webrtc-v5.0.13","libp2p-v2.1.9","circuit-relay-v2-v2.1.5","webtransport-v5.0.12","websockets-v9.0.8","webrtc-v5.0.12","utils-v6.1.1","upnp-nat-v2.0.8","tls-v2.0.8","tcp-v10.0.9","simple-metrics-v1.2.4","pubsub-v10.0.8","prometheus-metrics-v4.2.2","pnet-v2.0.8","plaintext-v2.0.8","ping-v2.0.8","perf-v4.0.8","peer-store-v11.0.8","peer-record-v8.0.8","peer-id-v5.0.5","peer-collections-v6.0.8","multistream-select-v6.0.6","mplex-v11.0.8","mdns-v11.0.8","logger-v5.1.1","libp2p-v2.1.8","keychain-v5.0.7","kad-dht-v14.0.1","interface-v2.1.3","interface-internal-v2.0.8","interface-compliance-tests-v6.1.6","identify-v3.0.8","floodsub-v10.1.6","fetch-v2.0.8","echo-v2.0.8","devtools-metrics-v1.1.6","dcutr-v2.0.8","crypto-v5.0.5","circuit-relay-v2-v2.1.4","bootstrap-v11.0.8","autonat-v2.0.8","webtransport-v5.0.11","webrtc-v5.0.11","libp2p-v2.1.7","circuit-relay-v2-v2.1.3","webtransport-v5.0.10","websockets-v9.0.7","webrtc-v5.0.10","utils-v6.1.0","upnp-nat-v2.0.7","tls-v2.0.7","tcp-v10.0.8","pubsub-v10.0.7","prometheus-metrics-v4.2.1","pnet-v2.0.7","plaintext-v2.0.7","ping-v2.0.7","perf-v4.0.7","peer-store-v11.0.7","peer-record-v8.0.7","peer-collections-v6.0.7","mplex-v11.0.7","mdns-v11.0.7","libp2p-v2.1.6","kad-dht-v14.0.0","interface-internal-v2.0.7","interface-compliance-tests-v6.1.5","identify-v3.0.7","floodsub-v10.1.5","fetch-v2.0.7","echo-v2.0.7","devtools-metrics-v1.1.5","dcutr-v2.0.7","circuit-relay-v2-v2.1.2","bootstrap-v11.0.7","autonat-v2.0.7","webtransport-v5.0.9","webrtc-v5.0.9","tcp-v10.0.7","libp2p-v2.1.5","kad-dht-v13.1.2","webtransport-v5.0.8","websockets-v9.0.6","webrtc-v5.0.8","utils-v6.0.6","upnp-nat-v2.0.6","tls-v2.0.6","tcp-v10.0.6","pubsub-v10.0.6","prometheus-metrics-v4.2.0","pnet-v2.0.6","plaintext-v2.0.6","ping-v2.0.6","perf-v4.0.6","peer-store-v11.0.6","peer-record-v8.0.6","peer-collections-v6.0.6","mplex-v11.0.6","mdns-v11.0.6","libp2p-v2.1.4","kad-dht-v13.1.1","interface-internal-v2.0.6","interface-compliance-tests-v6.1.4","identify-v3.0.6","floodsub-v10.1.4","fetch-v2.0.6","echo-v2.0.6","devtools-metrics-v1.1.4","dcutr-v2.0.6","circuit-relay-v2-v2.1.1","bootstrap-v11.0.6","autonat-v2.0.6","webtransport-v5.0.7","websockets-v9.0.5","webrtc-v5.0.7","utils-v6.0.5","upnp-nat-v2.0.5","tls-v2.0.5","tcp-v10.0.5","simple-metrics-v1.2.3","pubsub-v10.0.5","prometheus-metrics-v4.1.3","pnet-v2.0.5","plaintext-v2.0.5","ping-v2.0.5","perf-v4.0.5","peer-store-v11.0.5","peer-record-v8.0.5","peer-collections-v6.0.5","multistream-select-v6.0.5","mplex-v11.0.5","mdns-v11.0.5","logger-v5.1.0","libp2p-v2.1.3","keychain-v5.0.6","kad-dht-v13.1.0","interface-internal-v2.0.5","interface-compliance-tests-v6.1.3","identify-v3.0.5","floodsub-v10.1.3","fetch-v2.0.5","echo-v2.0.5","devtools-metrics-v1.1.3","dcutr-v2.0.5","circuit-relay-v2-v2.1.0","bootstrap-v11.0.5","autonat-v2.0.5","webtransport-v5.0.6","websockets-v9.0.4","webrtc-v5.0.6","utils-v6.0.4","upnp-nat-v2.0.4","tls-v2.0.4","tcp-v10.0.4","simple-metrics-v1.2.2","pubsub-v10.0.4","prometheus-metrics-v4.1.2","pnet-v2.0.4","plaintext-v2.0.4","ping-v2.0.4","perf-v4.0.4","peer-store-v11.0.4","peer-record-v8.0.4","peer-id-v5.0.4","peer-collections-v6.0.4","multistream-select-v6.0.4","mplex-v11.0.4","mdns-v11.0.4","logger-v5.0.4","libp2p-v2.1.2","keychain-v5.0.5","kad-dht-v13.0.4","interface-v2.1.2","interface-internal-v2.0.4","interface-compliance-tests-v6.1.2","identify-v3.0.4","floodsub-v10.1.2","fetch-v2.0.4","echo-v2.0.4","devtools-metrics-v1.1.2","dcutr-v2.0.4","crypto-v5.0.4","circuit-relay-v2-v2.0.4","bootstrap-v11.0.4","autonat-v2.0.4","webtransport-v5.0.5","websockets-v9.0.3","webrtc-v5.0.5","utils-v6.0.3","upnp-nat-v2.0.3","tls-v2.0.3","tcp-v10.0.3","simple-metrics-v1.2.1","pubsub-v10.0.3","prometheus-metrics-v4.1.1","pnet-v2.0.3","plaintext-v2.0.3","ping-v2.0.3","perf-v4.0.3","peer-store-v11.0.3","peer-record-v8.0.3","peer-id-v5.0.3","peer-collections-v6.0.3","multistream-select-v6.0.3","mplex-v11.0.3","mdns-v11.0.3","logger-v5.0.3","libp2p-v2.1.1","keychain-v5.0.4","kad-dht-v13.0.3","interface-v2.1.1","interface-internal-v2.0.3","interface-compliance-tests-v6.1.1","identify-v3.0.3","floodsub-v10.1.1","fetch-v2.0.3","echo-v2.0.3","devtools-metrics-v1.1.1","dcutr-v2.0.3","crypto-v5.0.3","circuit-relay-v2-v2.0.3","bootstrap-v11.0.3","autonat-v2.0.3","webtransport-v5.0.4","webrtc-v5.0.4","libp2p-v2.1.0","webtransport-v5.0.3","websockets-v9.0.2","webrtc-v5.0.3","utils-v6.0.2","upnp-nat-v2.0.2","tls-v2.0.2","tcp-v10.0.2","simple-metrics-v1.2.0","pubsub-v10.0.2","prometheus-metrics-v4.1.0","pnet-v2.0.2","plaintext-v2.0.2","ping-v2.0.2","perf-v4.0.2","peer-store-v11.0.2","peer-record-v8.0.2","peer-id-v5.0.2","peer-collections-v6.0.2","multistream-select-v6.0.2","mplex-v11.0.2","mdns-v11.0.2","logger-v5.0.2","libp2p-v2.0.3","keychain-v5.0.3","kad-dht-v13.0.2","interface-v2.1.0","interface-internal-v2.0.2","interface-compliance-tests-v6.1.0","identify-v3.0.2","floodsub-v10.1.0","fetch-v2.0.2","echo-v2.0.2","devtools-metrics-v1.1.0","dcutr-v2.0.2","crypto-v5.0.2","circuit-relay-v2-v2.0.2","bootstrap-v11.0.2","autonat-v2.0.2","keychain-v5.0.2","webtransport-v5.0.2","websockets-v9.0.1","webrtc-v5.0.2","utils-v6.0.1","upnp-nat-v2.0.1","tls-v2.0.1","tcp-v10.0.1","simple-metrics-v1.1.7","pubsub-v10.0.1","prometheus-metrics-v4.0.1","pnet-v2.0.1","plaintext-v2.0.1","ping-v2.0.1","perf-v4.0.1","peer-store-v11.0.1","peer-record-v8.0.1","peer-id-v5.0.1","peer-collections-v6.0.1","multistream-select-v6.0.1","mplex-v11.0.1","mdns-v11.0.1","logger-v5.0.1","libp2p-v2.0.2","keychain-v5.0.1","kad-dht-v13.0.1","interface-v2.0.1","interface-internal-v2.0.1","interface-compliance-tests-v6.0.1","identify-v3.0.1","floodsub-v10.0.1","fetch-v2.0.1","echo-v2.0.1","devtools-metrics-v1.0.1","dcutr-v2.0.1","crypto-v5.0.1","circuit-relay-v2-v2.0.1","bootstrap-v11.0.1","autonat-v2.0.1","webtransport-v5.0.1","webrtc-v5.0.1","libp2p-v2.0.1","webtransport-v5.0.0","websockets-v9.0.0","webrtc-v5.0.0","utils-v6.0.0","upnp-nat-v2.0.0","tls-v2.0.0","tcp-v10.0.0","simple-metrics-v1.1.6","pubsub-v10.0.0","prometheus-metrics-v4.0.0","pnet-v2.0.0","plaintext-v2.0.0","ping-v2.0.0","perf-v4.0.0","peer-store-v11.0.0","peer-record-v8.0.0","peer-id-v5.0.0","peer-collections-v6.0.0","multistream-select-v6.0.0","mplex-v11.0.0","mdns-v11.0.0","logger-v5.0.0","libp2p-v2.0.0","keychain-v5.0.0","kad-dht-v13.0.0","interface-v2.0.0","interface-internal-v2.0.0","interface-compliance-tests-v6.0.0","identify-v3.0.0","floodsub-v10.0.0","fetch-v2.0.0","echo-v2.0.0","devtools-metrics-v1.0.0","dcutr-v2.0.0","crypto-v5.0.0","circuit-relay-v2-v2.0.0","bootstrap-v11.0.0","autonat-v2.0.0","webtransport-v4.1.9","webrtc-v4.1.10","tcp-v9.1.6","libp2p-v1.9.4","webrtc-v4.1.9","webtransport-v4.1.8","webrtc-v4.1.8","ping-v1.1.6","libp2p-v1.9.3","keychain-v4.1.6","webtransport-v4.1.7","webrtc-v4.1.7","libp2p-v1.9.2","webtransport-v4.1.6","webrtc-v4.1.6","plaintext-v1.1.6","libp2p-v1.9.1","webtransport-v4.1.5","websockets-v8.2.0","webrtc-v4.1.5","utils-v5.4.9","upnp-nat-v1.2.5","tls-v1.1.5","tcp-v9.1.5","simple-metrics-v1.1.5","pubsub-v9.0.26","prometheus-metrics-v3.1.5","plaintext-v1.1.5","ping-v1.1.5","perf-v3.1.5","peer-store-v10.1.5","peer-record-v7.0.25","peer-id-v4.2.4","peer-id-factory-v4.2.4","peer-collections-v5.2.9","multistream-select-v5.1.17","mplex-v10.1.5","mdns-v10.1.5","logger-v4.0.20","libp2p-v1.9.0","keychain-v4.1.5","kad-dht-v12.1.5","interface-v1.7.0","interface-internal-v1.3.4","interface-compliance-tests-v5.4.12","identify-v2.1.5","floodsub-v9.1.5","fetch-v1.1.5","echo-v1.1.5","devtools-metrics-v0.2.5","dcutr-v1.1.5","crypto-v4.1.9","circuit-relay-v2-v1.1.5","bootstrap-v10.1.5","autonat-v1.1.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77384.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}