Description

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T22:17:19.650Z",
  "pubdate": "2026-08-24T22:17:19.650Z",
  "executiveSummary": "An unauthenticated denial of service vulnerability exists within the reservation refresh path of the libp2p networking stack, specifically in @libp2p/circuit-relay-v2 relay servers prior to version 4.2.9.\nThe vulnerability arises from improper resource management during reservation refreshes in reservation-store.ts, where abort listeners accumulate unbounded with each incoming valid RESERVE request.\nAn external remote peer can continuously send valid RESERVE requests to systematically exhaust relay server memory through listener and closure growth, ultimately resulting in service disruption.\nNo special privileges or authentication are required for the remote attacker to initiate the exploitation vector, making public-facing relay servers highly susceptible to availability degradation.\nThe operational risk is severe for deployments utilizing affected versions of the library, as prolonged exploitation leads to application crashes and network partitions.",
  "technicalDetails": "The root cause of the vulnerability resides in the reservation-store.ts file of the @libp2p/circuit-relay-v2 package within the JavaScript implementation of libp2p.\nDuring the reservation refresh path, the implementation reuses the same retimeableSignal object but fails to properly manage abort listeners, causing it to unconditionally register an additional abort listener on every subsequent refresh operation.\nThe vulnerable component is exposed over the network via the libp2p circuit relay v2 protocol, handling incoming RESERVE requests from remote peers without requiring prior authentication or elevated privileges.\nThe attack flow proceeds as a remote peer repeatedly transmits valid RESERVE requests targeting the circuit relay server. Each incoming request triggers the flawed reservation refresh logic, attaching a new abort listener to the underlying signal without cleanup.\nAs the attacker sustains this stream of valid requests, closures and event listeners accumulate indefinitely in memory. This unbounded resource allocation causes a severe memory leak, degrading server performance and ultimately leading to a denial of service via application crash or resource exhaustion.\nThe affected software versions include all releases of libp2p prior to version 4.2.9."
}