{"id":"CVE-2026-86039","summary":"libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses","details":"libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.","aliases":["GHSA-vrf4-mx87-p53w"],"modified":"2026-09-18T03:48:32.152752771Z","published":"2026-09-17T15:19:00.697Z","database_specific":{"cwe_ids":["CWE-290","CWE-345"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86039.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86039.json"},{"type":"FIX","url":"https://github.com/libp2p/js-libp2p/commit/3bf5d395cbca1488eea6e87cd771e4613b661c30"},{"type":"FIX","url":"https://github.com/libp2p/js-libp2p/pull/3570"},{"type":"WEB","url":"https://github.com/libp2p/js-libp2p/releases/tag/peer-store-v12.0.24"},{"type":"ADVISORY","url":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86039"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libp2p/js-libp2p","events":[{"introduced":"08eb47154168f894a0b4847dcf4f42ff52e8420e"},{"fixed":"cf0dbb38a2bc86e4346660c804a873fefbbeab49"}],"database_specific":{"extracted_events":[{"introduced":"8.0.0"},{"fixed":"12.0.24"}],"source":"AFFECTED_FIELD"}}],"versions":["webtransport-v6.0.31","websockets-v10.1.16","webrtc-v6.0.26","utils-v7.2.4","upnp-nat-v4.0.23","transport-interop-libp2p-main-v1.0.32","tls-v3.1.5","tcp-v11.0.23","simple-metrics-v2.0.18","record-v4.0.15","prometheus-metrics-v5.0.24","pnet-v3.0.24","plaintext-v3.0.23","ping-v3.1.8","perf-v5.1.8","peer-store-v12.0.23","peer-record-v9.0.13","peer-id-v6.0.12","peer-collections-v7.0.23","opentelemetry-metrics-v2.0.24","multistream-select-v7.0.23","mplex-v12.0.26","memory-v2.0.23","mdns-v12.0.26","logger-v6.2.10","libp2p-v3.3.5","keychain-v6.1.4","kad-dht-v16.3.4","interop-v14.0.31","interface-v3.2.5","interface-internal-v3.1.8","interface-compliance-tests-v7.0.26","integration-tests-v1.2.15","identify-v4.1.9","gossipsub-v16.0.4","floodsub-v11.0.25","fetch-v4.1.8","echo-v3.1.8","dcutr-v3.0.23","daemon-v6.0.31","daemon-server-v9.0.31","daemon-protocol-v8.0.10","daemon-client-v10.0.31","crypto-v5.1.21","config-v1.1.34","circuit-relay-v2-v4.2.8","bootstrap-v12.0.26","autonat-v3.0.23","autonat-v2-v2.0.23","webtransport-v6.0.30","websockets-v10.1.15","webrtc-v6.0.25","utils-v7.2.3","upnp-nat-v4.0.22","transport-interop-libp2p-main-v1.0.31","tls-v3.1.4","tcp-v11.0.22","simple-metrics-v2.0.17","record-v4.0.14","prometheus-metrics-v5.0.23","pnet-v3.0.23","plaintext-v3.0.22","ping-v3.1.7","perf-v5.1.7","peer-store-v12.0.22","peer-record-v9.0.12","peer-id-v6.0.11","peer-collections-v7.0.22","opentelemetry-metrics-v2.0.23","multistream-select-v7.0.22","mplex-v12.0.25","memory-v2.0.22","mdns-v12.0.25","logger-v6.2.9","libp2p-v3.3.4","keychain-v6.1.3","kad-dht-v16.3.3","interop-v14.0.30","interface-v3.2.4","interface-internal-v3.1.7","interface-compliance-tests-v7.0.25","integration-tests-v1.2.14","identify-v4.1.8","gossipsub-v16.0.3","floodsub-v11.0.24","fetch-v4.1.7","echo-v3.1.7","dcutr-v3.0.22","daemon-v6.0.30","daemon-server-v9.0.30","daemon-protocol-v8.0.9","daemon-client-v10.0.30","crypto-v5.1.20","config-v1.1.33","circuit-relay-v2-v4.2.7","bootstrap-v12.0.25","autonat-v3.0.22","autonat-v2-v2.0.22","webtransport-v6.0.29","transport-interop-libp2p-main-v1.0.30","kad-dht-v16.3.2","interop-v14.0.29","integration-tests-v1.2.13","gossipsub-v16.0.2","daemon-v6.0.29","daemon-server-v9.0.29","daemon-client-v10.0.29","webtransport-v6.0.28","websockets-v10.1.14","webrtc-v6.0.24","utils-v7.2.2","upnp-nat-v4.0.21","transport-interop-libp2p-main-v1.0.29","tls-v3.1.3","tcp-v11.0.21","simple-metrics-v2.0.16","record-v4.0.13","prometheus-metrics-v5.0.22","pnet-v3.0.22","plaintext-v3.0.21","ping-v3.1.6","perf-v5.1.6","peer-store-v12.0.21","peer-record-v9.0.11","peer-id-v6.0.10","peer-collections-v7.0.21","opentelemetry-metrics-v2.0.22","multistream-select-v7.0.21","mplex-v12.0.24","memory-v2.0.21","mdns-v12.0.24","logger-v6.2.8","libp2p-v3.3.3","keychain-v6.1.2","kad-dht-v16.3.1","interop-v14.0.28","interface-v3.2.3","interface-internal-v3.1.6","interface-compliance-tests-v7.0.24","integration-tests-v1.2.12","identify-v4.1.7","gossipsub-v16.0.1","floodsub-v11.0.23","fetch-v4.1.6","echo-v3.1.6","dcutr-v3.0.21","daemon-v6.0.28","daemon-server-v9.0.28","daemon-protocol-v8.0.8","daemon-client-v10.0.28","crypto-v5.1.19","config-v1.1.32","circuit-relay-v2-v4.2.6","bootstrap-v12.0.24","autonat-v3.0.21","autonat-v2-v2.0.21","webtransport-v6.0.27","transport-interop-libp2p-main-v1.0.28","mplex-v12.0.23","mdns-v12.0.23","libp2p-v3.3.2","interop-v14.0.27","interface-compliance-tests-v7.0.23","integration-tests-v1.2.11","gossipsub-v16.0.0","floodsub-v11.0.22","daemon-v6.0.27","daemon-server-v9.0.27","daemon-client-v10.0.27","bootstrap-v12.0.23","webtransport-v6.0.26","transport-interop-libp2p-main-v1.0.27","kad-dht-v16.3.0","interop-v14.0.26","integration-tests-v1.2.10","daemon-v6.0.26","daemon-server-v9.0.26","daemon-client-v10.0.26","webtransport-v6.0.25","websockets-v10.1.13","webrtc-v6.0.23","utils-v7.2.1","upnp-nat-v4.0.20","transport-interop-libp2p-main-v1.0.26","tls-v3.1.2","tcp-v11.0.20","prometheus-metrics-v5.0.21","pnet-v3.0.21","plaintext-v3.0.20","ping-v3.1.5","perf-v5.1.5","peer-store-v12.0.20","peer-collections-v7.0.20","opentelemetry-metrics-v2.0.21","multistream-select-v7.0.20","mplex-v12.0.22","memory-v2.0.20","mdns-v12.0.22","libp2p-v3.3.1","kad-dht-v16.2.7","interop-v14.0.25","interface-internal-v3.1.5","interface-compliance-tests-v7.0.22","integration-tests-v1.2.9","identify-v4.1.6","gossipsub-v15.0.23","floodsub-v11.0.21","fetch-v4.1.5","echo-v3.1.5","dcutr-v3.0.20","daemon-v6.0.25","daemon-server-v9.0.25","daemon-client-v10.0.25","circuit-relay-v2-v4.2.5","bootstrap-v12.0.22","autonat-v3.0.20","autonat-v2-v2.0.20","webtransport-v6.0.24","transport-interop-libp2p-main-v1.0.25","kad-dht-v16.2.6","interop-v14.0.24","integration-tests-v1.2.8","daemon-v6.0.24","daemon-server-v9.0.24","daemon-client-v10.0.24","transport-interop-libp2p-main-v1.0.24","integration-tests-v1.2.7","identify-v4.1.5","webtransport-v6.0.23","websockets-v10.1.12","webrtc-v6.0.22","utils-v7.2.0","upnp-nat-v4.0.19","transport-interop-libp2p-main-v1.0.23","tls-v3.1.1","tcp-v11.0.19","simple-metrics-v2.0.15","prometheus-metrics-v5.0.20","pnet-v3.0.20","plaintext-v3.0.19","ping-v3.1.4","perf-v5.1.4","peer-store-v12.0.19","peer-record-v9.0.10","peer-id-v6.0.9","peer-collections-v7.0.19","opentelemetry-metrics-v2.0.20","multistream-select-v7.0.19","mplex-v12.0.21","memory-v2.0.19","mdns-v12.0.21","logger-v6.2.7","libp2p-v3.3.0","keychain-v6.1.1","kad-dht-v16.2.5","interop-v14.0.23","interface-internal-v3.1.4","interface-compliance-tests-v7.0.21","integration-tests-v1.2.6","identify-v4.1.4","gossipsub-v15.0.22","floodsub-v11.0.20","fetch-v4.1.4","echo-v3.1.4","dcutr-v3.0.19","daemon-v6.0.23","daemon-server-v9.0.23","daemon-client-v10.0.23","crypto-v5.1.18","config-v1.1.31","circuit-relay-v2-v4.2.4","bootstrap-v12.0.21","autonat-v3.0.19","autonat-v2-v2.0.19","webtransport-v6.0.22","webrtc-v6.0.21","transport-interop-libp2p-main-v1.0.22","mplex-v12.0.20","mdns-v12.0.20","libp2p-v3.2.4","interop-v14.0.22","interface-compliance-tests-v7.0.20","integration-tests-v1.2.5","gossipsub-v15.0.21","daemon-v6.0.22","daemon-server-v9.0.22","daemon-client-v10.0.22","bootstrap-v12.0.20","webtransport-v6.0.21","websockets-v10.1.11","webrtc-v6.0.20","utils-v7.1.0","upnp-nat-v4.0.18","transport-interop-libp2p-main-v1.0.21","tls-v3.1.0","tcp-v11.0.18","prometheus-metrics-v5.0.19","pnet-v3.0.19","plaintext-v3.0.18","ping-v3.1.3","perf-v5.1.3","peer-store-v12.0.18","peer-collections-v7.0.18","opentelemetry-metrics-v2.0.19","multistream-select-v7.0.18","mplex-v12.0.19","memory-v2.0.18","mdns-v12.0.19","libp2p-v3.2.3","keychain-v6.1.0","kad-dht-v16.2.4","interop-v14.0.21","interface-internal-v3.1.3","interface-compliance-tests-v7.0.19","integration-tests-v1.2.4","identify-v4.1.3","gossipsub-v15.0.20","floodsub-v11.0.19","fetch-v4.1.3","echo-v3.1.3","dcutr-v3.0.18","daemon-v6.0.21","daemon-server-v9.0.21","daemon-client-v10.0.21","config-v1.1.30","circuit-relay-v2-v4.2.3","bootstrap-v12.0.19","autonat-v3.0.18","autonat-v2-v2.0.18","webtransport-v6.0.20","webrtc-v6.0.19","transport-interop-libp2p-main-v1.0.20","kad-dht-v16.2.3","interop-v14.0.20","integration-tests-v1.2.3","daemon-v6.0.20","daemon-server-v9.0.20","daemon-client-v10.0.20","webtransport-v6.0.19","websockets-v10.1.10","webrtc-v6.0.18","utils-v7.0.17","upnp-nat-v4.0.17","transport-interop-libp2p-main-v1.0.19","tls-v3.0.17","tcp-v11.0.17","simple-metrics-v2.0.14","record-v4.0.12","prometheus-metrics-v5.0.18","pnet-v3.0.18","plaintext-v3.0.17","ping-v3.1.2","perf-v5.1.2","peer-store-v12.0.17","peer-record-v9.0.9","peer-id-v6.0.8","peer-collections-v7.0.17","opentelemetry-metrics-v2.0.18","multistream-select-v7.0.17","mplex-v12.0.18","memory-v2.0.17","mdns-v12.0.18","logger-v6.2.6","libp2p-v3.2.2","keychain-v6.0.14","kad-dht-v16.2.2","interop-v14.0.19","interface-v3.2.2","interface-internal-v3.1.2","interface-compliance-tests-v7.0.18","integration-tests-v1.2.2","identify-v4.1.2","gossipsub-v15.0.19","floodsub-v11.0.18","fetch-v4.1.2","echo-v3.1.2","dcutr-v3.0.17","daemon-v6.0.19","daemon-server-v9.0.19","daemon-protocol-v8.0.7","daemon-client-v10.0.19","crypto-v5.1.17","config-v1.1.29","circuit-relay-v2-v4.2.2","bootstrap-v12.0.18","autonat-v3.0.17","autonat-v2-v2.0.17","webtransport-v6.0.18","websockets-v10.1.9","webrtc-v6.0.17","utils-v7.0.16","upnp-nat-v4.0.16","transport-interop-libp2p-main-v1.0.18","tls-v3.0.16","tcp-v11.0.16","simple-metrics-v2.0.13","record-v4.0.11","prometheus-metrics-v5.0.17","pnet-v3.0.17","plaintext-v3.0.16","ping-v3.1.1","perf-v5.1.1","peer-store-v12.0.16","peer-record-v9.0.8","peer-id-v6.0.7","peer-collections-v7.0.16","opentelemetry-metrics-v2.0.17","multistream-select-v7.0.16","mplex-v12.0.17","memory-v2.0.16","mdns-v12.0.17","logger-v6.2.5","libp2p-v3.2.1","keychain-v6.0.13","kad-dht-v16.2.1","interop-v14.0.18","interface-v3.2.1","interface-internal-v3.1.1","interface-compliance-tests-v7.0.17","integration-tests-v1.2.1","identify-v4.1.1","gossipsub-v15.0.18","floodsub-v11.0.17","fetch-v4.1.1","echo-v3.1.1","dcutr-v3.0.16","daemon-v6.0.18","daemon-server-v9.0.18","daemon-protocol-v8.0.6","daemon-client-v10.0.18","crypto-v5.1.16","config-v1.1.28","circuit-relay-v2-v4.2.1","bootstrap-v12.0.17","autonat-v3.0.16","autonat-v2-v2.0.16","webtransport-v6.0.17","websockets-v10.1.8","webrtc-v6.0.16","utils-v7.0.15","upnp-nat-v4.0.15","transport-interop-libp2p-main-v1.0.17","tls-v3.0.15","tcp-v11.0.15","simple-metrics-v2.0.12","prometheus-metrics-v5.0.16","pnet-v3.0.16","plaintext-v3.0.15","ping-v3.1.0","perf-v5.1.0","peer-store-v12.0.15","peer-record-v9.0.7","peer-id-v6.0.6","peer-collections-v7.0.15","opentelemetry-metrics-v2.0.16","multistream-select-v7.0.15","mplex-v12.0.16","memory-v2.0.15","mdns-v12.0.16","logger-v6.2.4","libp2p-v3.2.0","keychain-v6.0.12","kad-dht-v16.2.0","interop-v14.0.17","interface-v3.2.0","interface-internal-v3.1.0","interface-compliance-tests-v7.0.16","integration-tests-v1.2.0","identify-v4.1.0","gossipsub-v15.0.17","floodsub-v11.0.16","fetch-v4.1.0","echo-v3.1.0","dcutr-v3.0.15","daemon-v6.0.17","daemon-server-v9.0.17","daemon-protocol-v8.0.5","daemon-client-v10.0.17","crypto-v5.1.15","config-v1.1.27","circuit-relay-v2-v4.2.0","bootstrap-v12.0.16","autonat-v3.0.15","autonat-v2-v2.0.15","webtransport-v6.0.16","websockets-v10.1.7","webrtc-v6.0.15","utils-v7.0.14","upnp-nat-v4.0.14","transport-interop-libp2p-main-v1.0.16","tls-v3.0.14","tcp-v11.0.14","simple-metrics-v2.0.11","record-v4.0.10","prometheus-metrics-v5.0.15","pnet-v3.0.15","plaintext-v3.0.14","ping-v3.0.14","perf-v5.0.15","peer-store-v12.0.14","peer-record-v9.0.6","peer-id-v6.0.5","peer-collections-v7.0.14","opentelemetry-metrics-v2.0.15","multistream-select-v7.0.14","mplex-v12.0.15","memory-v2.0.14","mdns-v12.0.15","logger-v6.2.3","libp2p-v3.1.7","keychain-v6.0.11","kad-dht-v16.1.7","interop-v14.0.16","interface-v3.1.1","interface-internal-v3.0.14","interface-compliance-tests-v7.0.15","integration-tests-v1.1.7","identify-v4.0.14","gossipsub-v15.0.16","floodsub-v11.0.15","fetch-v4.0.14","echo-v3.0.15","dcutr-v3.0.14","daemon-v6.0.16","daemon-server-v9.0.16","daemon-protocol-v8.0.4","daemon-client-v10.0.16","crypto-v5.1.14","config-v1.1.26","circuit-relay-v2-v4.1.7","bootstrap-v12.0.15","autonat-v3.0.14","autonat-v2-v2.0.14","webtransport-v6.0.15","websockets-v10.1.6","webrtc-v6.0.14","utils-v7.0.13","upnp-nat-v4.0.13","transport-interop-libp2p-main-v1.0.15","tls-v3.0.13","tcp-v11.0.13","prometheus-metrics-v5.0.14","pnet-v3.0.14","plaintext-v3.0.13","ping-v3.0.13","perf-v5.0.14","peer-store-v12.0.13","peer-collections-v7.0.13","opentelemetry-metrics-v2.0.14","multistream-select-v7.0.13","mplex-v12.0.14","memory-v2.0.13","mdns-v12.0.14","libp2p-v3.1.6","kad-dht-v16.1.6","interop-v14.0.15","interface-internal-v3.0.13","interface-compliance-tests-v7.0.14","integration-tests-v1.1.6","identify-v4.0.13","gossipsub-v15.0.15","floodsub-v11.0.14","fetch-v4.0.13","echo-v3.0.14","dcutr-v3.0.13","daemon-v6.0.15","daemon-server-v9.0.15","daemon-client-v10.0.15","circuit-relay-v2-v4.1.6","bootstrap-v12.0.14","autonat-v3.0.13","autonat-v2-v2.0.13","webtransport-v6.0.12","websockets-v10.1.3","webrtc-v6.0.11","utils-v7.0.10","upnp-nat-v4.0.10","transport-interop-libp2p-main-v1.0.12","tls-v3.0.10","tcp-v11.0.10","record-v4.0.9","prometheus-metrics-v5.0.10","pnet-v3.0.11","plaintext-v3.0.10","ping-v3.0.10","perf-v5.0.11","peer-store-v12.0.10","peer-record-v9.0.5","peer-collections-v7.0.10","opentelemetry-metrics-v2.0.10","multistream-select-v7.0.10","mplex-v12.0.11","memory-v2.0.10","mdns-v12.0.11","libp2p-v3.1.3","keychain-v6.0.10","kad-dht-v16.1.3","interop-v14.0.12","interface-internal-v3.0.10","interface-compliance-tests-v7.0.11","integration-tests-v1.1.3","identify-v4.0.10","gossipsub-v15.0.12","floodsub-v11.0.11","fetch-v4.0.10","echo-v3.0.11","dcutr-v3.0.10","daemon-v6.0.12","daemon-server-v9.0.12","daemon-client-v10.0.12","config-v1.1.25","circuit-relay-v2-v4.1.3","bootstrap-v12.0.11","autonat-v3.0.10","autonat-v2-v2.0.10","simple-metrics-v2.0.10","prometheus-metrics-v5.0.13","opentelemetry-metrics-v2.0.13","webtransport-v6.0.14","websockets-v10.1.5","webrtc-v6.0.13","utils-v7.0.12","upnp-nat-v4.0.12","transport-interop-libp2p-main-v1.0.14","tls-v3.0.12","tcp-v11.0.12","prometheus-metrics-v5.0.12","pnet-v3.0.13","plaintext-v3.0.12","ping-v3.0.12","perf-v5.0.13","peer-store-v12.0.12","peer-collections-v7.0.12","opentelemetry-metrics-v2.0.12","multistream-select-v7.0.12","mplex-v12.0.13","memory-v2.0.12","mdns-v12.0.13","libp2p-v3.1.5","kad-dht-v16.1.5","interop-v14.0.14","interface-internal-v3.0.12","interface-compliance-tests-v7.0.13","integration-tests-v1.1.5","identify-v4.0.12","gossipsub-v15.0.14","floodsub-v11.0.13","fetch-v4.0.12","echo-v3.0.13","dcutr-v3.0.12","daemon-v6.0.14","daemon-server-v9.0.14","daemon-client-v10.0.14","circuit-relay-v2-v4.1.5","bootstrap-v12.0.13","autonat-v3.0.12","autonat-v2-v2.0.12","webtransport-v6.0.13","websockets-v10.1.4","webrtc-v6.0.12","utils-v7.0.11","upnp-nat-v4.0.11","transport-interop-libp2p-main-v1.0.13","tls-v3.0.11","tcp-v11.0.11","prometheus-metrics-v5.0.11","pnet-v3.0.12","plaintext-v3.0.11","ping-v3.0.11","perf-v5.0.12","peer-store-v12.0.11","peer-collections-v7.0.11","opentelemetry-metrics-v2.0.11","multistream-select-v7.0.11","mplex-v12.0.12","memory-v2.0.11","mdns-v12.0.12","libp2p-v3.1.4","kad-dht-v16.1.4","interop-v14.0.13","interface-internal-v3.0.11","interface-compliance-tests-v7.0.12","integration-tests-v1.1.4","identify-v4.0.11","gossipsub-v15.0.13","floodsub-v11.0.12","fetch-v4.0.11","echo-v3.0.12","dcutr-v3.0.11","daemon-v6.0.13","daemon-server-v9.0.13","daemon-client-v10.0.13","circuit-relay-v2-v4.1.4","bootstrap-v12.0.12","autonat-v3.0.11","autonat-v2-v2.0.11","webtransport-v6.0.11","websockets-v10.1.2","webrtc-v6.0.10","utils-v7.0.9","upnp-nat-v4.0.9","transport-interop-libp2p-main-v1.0.11","tls-v3.0.9","tcp-v11.0.9","simple-metrics-v2.0.9","prometheus-metrics-v5.0.9","pnet-v3.0.10","plaintext-v3.0.9","ping-v3.0.9","perf-v5.0.10","peer-store-v12.0.9","peer-collections-v7.0.9","opentelemetry-metrics-v2.0.9","multistream-select-v7.0.9","mplex-v12.0.10","memory-v2.0.9","mdns-v12.0.10","logger-v6.2.2","libp2p-v3.1.2","keychain-v6.0.9","kad-dht-v16.1.2","interop-v14.0.11","interface-internal-v3.0.9","interface-compliance-tests-v7.0.10","integration-tests-v1.1.2","identify-v4.0.9","gossipsub-v15.0.11","floodsub-v11.0.10","fetch-v4.0.9","echo-v3.0.10","dcutr-v3.0.9","daemon-v6.0.11","daemon-server-v9.0.11","daemon-client-v10.0.11","config-v1.1.24","circuit-relay-v2-v4.1.2","bootstrap-v12.0.10","autonat-v3.0.9","autonat-v2-v2.0.9","webtransport-v6.0.10","websockets-v10.1.1","webrtc-v6.0.9","utils-v7.0.8","upnp-nat-v4.0.8","transport-interop-libp2p-main-v1.0.10","tls-v3.0.8","tcp-v11.0.8","simple-metrics-v2.0.8","prometheus-metrics-v5.0.8","pnet-v3.0.9","plaintext-v3.0.8","ping-v3.0.8","perf-v5.0.9","peer-store-v12.0.8","peer-collections-v7.0.8","opentelemetry-metrics-v2.0.8","multistream-select-v7.0.8","mplex-v12.0.9","memory-v2.0.8","mdns-v12.0.9","logger-v6.2.1","libp2p-v3.1.1","keychain-v6.0.8","kad-dht-v16.1.1","interop-v14.0.10","interface-internal-v3.0.8","interface-compliance-tests-v7.0.9","integration-tests-v1.1.1","identify-v4.0.8","gossipsub-v15.0.10","floodsub-v11.0.9","fetch-v4.0.8","echo-v3.0.9","dcutr-v3.0.8","daemon-v6.0.10","daemon-server-v9.0.10","daemon-client-v10.0.10","config-v1.1.23","circuit-relay-v2-v4.1.1","bootstrap-v12.0.9","autonat-v3.0.8","autonat-v2-v2.0.8","webtransport-v6.0.9","websockets-v10.1.0","webrtc-v6.0.8","utils-v7.0.7","upnp-nat-v4.0.7","transport-interop-libp2p-main-v1.0.9","tls-v3.0.7","tcp-v11.0.7","simple-metrics-v2.0.7","prometheus-metrics-v5.0.7","pnet-v3.0.8","plaintext-v3.0.7","ping-v3.0.7","perf-v5.0.8","peer-store-v12.0.7","peer-record-v9.0.4","peer-id-v6.0.4","peer-collections-v7.0.7","opentelemetry-metrics-v2.0.7","multistream-select-v7.0.7","mplex-v12.0.8","memory-v2.0.7","mdns-v12.0.8","logger-v6.2.0","libp2p-v3.1.0","keychain-v6.0.7","kad-dht-v16.1.0","interop-v14.0.9","interface-v3.1.0","interface-internal-v3.0.7","interface-compliance-tests-v7.0.8","integration-tests-v1.1.0","identify-v4.0.7","gossipsub-v15.0.9","floodsub-v11.0.8","fetch-v4.0.7","echo-v3.0.8","dcutr-v3.0.7","daemon-v6.0.9","daemon-server-v9.0.9","daemon-protocol-v8.0.3","daemon-client-v10.0.9","crypto-v5.1.13","config-v1.1.22","circuit-relay-v2-v4.1.0","bootstrap-v12.0.8","autonat-v3.0.7","autonat-v2-v2.0.7","webtransport-v6.0.8","websockets-v10.0.7","webrtc-v6.0.7","utils-v7.0.6","upnp-nat-v4.0.6","transport-interop-libp2p-main-v1.0.8","tls-v3.0.6","tcp-v11.0.6","simple-metrics-v2.0.6","prometheus-metrics-v5.0.6","pnet-v3.0.7","plaintext-v3.0.6","ping-v3.0.6","perf-v5.0.7","peer-store-v12.0.6","peer-collections-v7.0.6","opentelemetry-metrics-v2.0.6","multistream-select-v7.0.6","mplex-v12.0.7","memory-v2.0.6","mdns-v12.0.7","logger-v6.1.0","libp2p-v3.0.7","keychain-v6.0.6","kad-dht-v16.0.6","interop-v14.0.8","interface-internal-v3.0.6","interface-compliance-tests-v7.0.7","integration-tests-v1.0.8","identify-v4.0.6","gossipsub-v15.0.8","floodsub-v11.0.7","fetch-v4.0.6","echo-v3.0.7","dcutr-v3.0.6","daemon-v6.0.8","daemon-server-v9.0.8","daemon-client-v10.0.8","config-v1.1.21","circuit-relay-v2-v4.0.6","bootstrap-v12.0.7","autonat-v3.0.6","autonat-v2-v2.0.6","webtransport-v6.0.7","websockets-v10.0.6","webrtc-v6.0.6","utils-v7.0.5","upnp-nat-v4.0.5","transport-interop-libp2p-main-v1.0.7","tls-v3.0.5","tcp-v11.0.5","simple-metrics-v2.0.5","prometheus-metrics-v5.0.5","pnet-v3.0.6","plaintext-v3.0.5","ping-v3.0.5","perf-v5.0.6","peer-store-v12.0.5","peer-collections-v7.0.5","opentelemetry-metrics-v2.0.5","multistream-select-v7.0.5","mplex-v12.0.6","memory-v2.0.5","mdns-v12.0.6","logger-v6.0.5","libp2p-v3.0.6","keychain-v6.0.5","kad-dht-v16.0.5","interop-v14.0.7","interface-internal-v3.0.5","interface-compliance-tests-v7.0.6","integration-tests-v1.0.7","identify-v4.0.5","gossipsub-v15.0.7","floodsub-v11.0.6","fetch-v4.0.5","echo-v3.0.6","dcutr-v3.0.5","daemon-v6.0.7","daemon-server-v9.0.7","daemon-client-v10.0.7","config-v1.1.20","circuit-relay-v2-v4.0.5","bootstrap-v12.0.6","autonat-v3.0.5","autonat-v2-v2.0.5","webtransport-v6.0.6","websockets-v10.0.5","webrtc-v6.0.5","utils-v7.0.4","upnp-nat-v4.0.4","transport-interop-libp2p-main-v1.0.6","tls-v3.0.4","tcp-v11.0.4","simple-metrics-v2.0.4","prometheus-metrics-v5.0.4","pnet-v3.0.5","plaintext-v3.0.4","ping-v3.0.4","perf-v5.0.5","peer-store-v12.0.4","peer-record-v9.0.3","peer-id-v6.0.3","peer-collections-v7.0.4","opentelemetry-metrics-v2.0.4","multistream-select-v7.0.4","mplex-v12.0.5","memory-v2.0.4","mdns-v12.0.5","logger-v6.0.4","libp2p-v3.0.5","keychain-v6.0.4","kad-dht-v16.0.4","interop-v14.0.6","interface-v3.0.2","interface-internal-v3.0.4","interface-compliance-tests-v7.0.5","integration-tests-v1.0.6","identify-v4.0.4","gossipsub-v15.0.6","floodsub-v11.0.5","fetch-v4.0.4","echo-v3.0.5","dcutr-v3.0.4","daemon-v6.0.6","daemon-server-v9.0.6","daemon-protocol-v8.0.2","daemon-client-v10.0.6","crypto-v5.1.12","config-v1.1.19","circuit-relay-v2-v4.0.4","bootstrap-v12.0.5","autonat-v3.0.4","autonat-v2-v2.0.4","webtransport-v6.0.5","websockets-v10.0.4","webrtc-v6.0.4","utils-v7.0.3","upnp-nat-v4.0.3","transport-interop-libp2p-main-v1.0.5","tls-v3.0.3","tcp-v11.0.3","simple-metrics-v2.0.3","prometheus-metrics-v5.0.3","pnet-v3.0.4","plaintext-v3.0.3","ping-v3.0.3","perf-v5.0.4","peer-store-v12.0.3","peer-record-v9.0.2","peer-id-v6.0.2","peer-collections-v7.0.3","opentelemetry-metrics-v2.0.3","multistream-select-v7.0.3","mplex-v12.0.4","memory-v2.0.3","mdns-v12.0.4","logger-v6.0.3","libp2p-v3.0.4","keychain-v6.0.3","kad-dht-v16.0.3","interop-v14.0.5","interface-v3.0.1","interface-internal-v3.0.3","interface-compliance-tests-v7.0.4","integration-tests-v1.0.5","identify-v4.0.3","gossipsub-v15.0.5","floodsub-v11.0.4","fetch-v4.0.3","echo-v3.0.4","dcutr-v3.0.3","daemon-v6.0.5","daemon-server-v9.0.5","daemon-protocol-v8.0.1","daemon-client-v10.0.5","crypto-v5.1.11","config-v1.1.18","circuit-relay-v2-v4.0.3","bootstrap-v12.0.4","autonat-v3.0.3","autonat-v2-v2.0.3","pnet-v3.0.3","webtransport-v6.0.4","websockets-v10.0.3","webrtc-v6.0.3","utils-v7.0.2","upnp-nat-v4.0.2","transport-interop-libp2p-main-v1.0.4","tls-v3.0.2","tcp-v11.0.2","simple-metrics-v2.0.2","prometheus-metrics-v5.0.2","pnet-v3.0.2","plaintext-v3.0.2","ping-v3.0.2","perf-v5.0.3","peer-store-v12.0.2","peer-collections-v7.0.2","opentelemetry-metrics-v2.0.2","multistream-select-v7.0.2","mplex-v12.0.3","memory-v2.0.2","mdns-v12.0.3","logger-v6.0.2","libp2p-v3.0.3","keychain-v6.0.2","kad-dht-v16.0.2","interop-v14.0.4","interface-internal-v3.0.2","interface-compliance-tests-v7.0.3","integration-tests-v1.0.4","identify-v4.0.2","gossipsub-v15.0.4","floodsub-v11.0.3","fetch-v4.0.2","echo-v3.0.3","dcutr-v3.0.2","daemon-v6.0.4","daemon-server-v9.0.4","daemon-client-v10.0.4","config-v1.1.17","circuit-relay-v2-v4.0.2","bootstrap-v12.0.3","autonat-v3.0.2","autonat-v2-v2.0.2","webtransport-v6.0.3","websockets-v10.0.2","transport-interop-libp2p-main-v1.0.3","interop-v14.0.3","integration-tests-v1.0.3","gossipsub-v15.0.3","floodsub-v11.0.2","daemon-v6.0.3","daemon-server-v9.0.3","daemon-client-v10.0.3","webtransport-v6.0.2","webrtc-v6.0.2","transport-interop-libp2p-main-v1.0.2","perf-v5.0.2","mplex-v12.0.2","mdns-v12.0.2","libp2p-v3.0.2","interop-v14.0.2","interface-compliance-tests-v7.0.2","integration-tests-v1.0.2","gossipsub-v15.0.2","echo-v3.0.2","daemon-v6.0.2","daemon-server-v9.0.2","daemon-client-v10.0.2","bootstrap-v12.0.2","yamux-v8.0.1","webtransport-v6.0.1","websockets-v10.0.1","webrtc-v6.0.1","utils-v7.0.1","upnp-nat-v4.0.1","transport-interop-libp2p-main-v1.0.1","tls-v3.0.1","tcp-v11.0.1","simple-metrics-v2.0.1","prometheus-metrics-v5.0.1","pnet-v3.0.1","plaintext-v3.0.1","ping-v3.0.1","perf-v5.0.1","peer-store-v12.0.1","peer-record-v9.0.1","peer-id-v6.0.1","peer-collections-v7.0.1","opentelemetry-metrics-v2.0.1","noise-v1.0.1","multistream-select-v7.0.1","mplex-v12.0.1","memory-v2.0.1","mdns-v12.0.1","logger-v6.0.1","libp2p-v3.0.1","keychain-v6.0.1","kad-dht-v16.0.1","interop-v14.0.1","interface-internal-v3.0.1","interface-compliance-tests-v7.0.1","integration-tests-v1.0.1","identify-v4.0.1","gossipsub-v15.0.1","floodsub-v11.0.1","fetch-v4.0.1","echo-v3.0.1","dcutr-v3.0.1","daemon-v6.0.1","daemon-server-v9.0.1","daemon-client-v10.0.1","crypto-v5.1.10","config-v1.1.16","circuit-relay-v2-v4.0.1","bootstrap-v12.0.1","autonat-v3.0.1","autonat-v2-v2.0.1","yamux-v8.0.0","webtransport-v6.0.0","websockets-v10.0.0","webrtc-v6.0.0","utils-v7.0.0","upnp-nat-v4.0.0","transport-interop-libp2p-main-v1.0.0","tls-v3.0.0","tcp-v11.0.0","simple-metrics-v2.0.0","record-v4.0.8","prometheus-metrics-v5.0.0","pnet-v3.0.0","plaintext-v3.0.0","ping-v3.0.0","perf-v5.0.0","peer-store-v12.0.0","peer-record-v9.0.0","peer-id-v6.0.0","peer-collections-v7.0.0","opentelemetry-metrics-v2.0.0","noise-v1.0.0","multistream-select-v7.0.0","mplex-v12.0.0","memory-v2.0.0","mdns-v12.0.0","logger-v6.0.0","libp2p-v3.0.0","keychain-v6.0.0","kad-dht-v16.0.0","interop-v14.0.0","interface-v3.0.0","interface-internal-v3.0.0","interface-compliance-tests-v7.0.0","integration-tests-v1.0.0","identify-v4.0.0","gossipsub-v15.0.0","floodsub-v11.0.0","fetch-v4.0.0","echo-v3.0.0","dcutr-v3.0.0","daemon-v6.0.0","daemon-server-v9.0.0","daemon-protocol-v8.0.0","daemon-client-v10.0.0","crypto-v5.1.9","config-v1.1.15","circuit-relay-v2-v4.0.0","bootstrap-v12.0.0","autonat-v3.0.0","autonat-v2-v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86039.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"}]}