{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-86039/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:libp2p:libp2p_peer_store:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-86039"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@libp2p/peer-store (\u003e= 8.0.0, \u003c 12.0.24)"],"_cs_severities":["medium"],"_cs_tags":["supply-chain","peer-to-peer","networking","cve-2026-86039"],"_cs_type":"advisory","_cs_vendors":["libp2p"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@libp2p/peer-store\u003c/code\u003e package contains a critical logic error in the \u003ccode\u003econsumePeerRecord\u003c/code\u003e function, identified as CVE-2026-86039. The vulnerability arises because the package verifies the cryptographic signature of the \u003ccode\u003ePeerRecord\u003c/code\u003e envelope but fails to verify that the signer of that envelope matches the \u003ccode\u003ePeerId\u003c/code\u003e embedded within the payload.\u003c/p\u003e\n\u003cp\u003eAn attacker can generate a signed \u003ccode\u003ePeerRecord\u003c/code\u003e using their own private key but specify the \u003ccode\u003ePeerId\u003c/code\u003e of a victim in the payload. When processed by a vulnerable node, the library treats the payload as authentic because the envelope signature is technically valid (signed by the attacker). Consequently, the node stores attacker-controlled multiaddrs as 'certified' addresses for the victim peer. Since libp2p connection logic prioritizes certified addresses during dialing, this vulnerability allows for address-book poisoning, dial redirection, and reachability disruption. This affects \u003ccode\u003e@libp2p/peer-store\u003c/code\u003e versions 8.0.0 through 12.0.23.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker generates a legitimate libp2p cryptographic key pair.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a \u003ccode\u003ePeerRecord\u003c/code\u003e object containing the victim's \u003ccode\u003ePeerId\u003c/code\u003e and the attacker's own malicious multiaddrs.\u003c/li\u003e\n\u003cli\u003eAttacker signs this \u003ccode\u003ePeerRecord\u003c/code\u003e using their own private key, creating a valid \u003ccode\u003eRecordEnvelope\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker transmits the forged envelope to a target node, typically through peer discovery protocols like GossipSub Peer Exchange (PX).\u003c/li\u003e\n\u003cli\u003eThe target node's \u003ccode\u003econsumePeerRecord\u003c/code\u003e function extracts the \u003ccode\u003ePeerId\u003c/code\u003e from the envelope signature and validates the signature successfully.\u003c/li\u003e\n\u003cli\u003eThe target node fails to compare the signer's identity against the \u003ccode\u003ePeerRecord.peerId\u003c/code\u003e field in the payload.\u003c/li\u003e\n\u003cli\u003eThe target node's \u003ccode\u003epeerStore.patch\u003c/code\u003e method commits the forged addresses to its local datastore, marking them as \u003ccode\u003eisCertified: true\u003c/code\u003e under the victim's identity.\u003c/li\u003e\n\u003cli\u003eFuture connection attempts by the target node to the victim peer are redirected to the attacker's infrastructure or result in connection failure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the poisoning of the target's peer-store cache. Because certified addresses are highly prioritized by libp2p connection logic, legitimate traffic intended for the victim peer is redirected to attacker-controlled endpoints. This can disrupt network connectivity, prevent legitimate peer communication, and facilitate further reconnaissance or man-in-the-middle attacks on the application layer. Thousands of decentralized applications and infrastructure nodes relying on libp2p for peer-to-peer networking are potentially affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for engineering and security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@libp2p/peer-store\u003c/code\u003e to version 12.0.24 or later to implement the required PeerId/signer identity invariant.\u003c/li\u003e\n\u003cli\u003eAudit existing PeerStore datastores for unexpected or unauthorized certified addresses associated with high-value peer IDs if the node has been exposed to untrusted peer records.\u003c/li\u003e\n\u003cli\u003eImplement strict peer-to-peer connection validation logic to ensure that connection upgrades and identity handshakes are not solely reliant on certified peer records stored in the local cache.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-17T19:10:38Z","date_published":"2026-09-17T19:10:38Z","id":"https://feed.craftedsignal.io/briefs/2026-09-libp2p-peer-store-hijack/","summary":"The @libp2p/peer-store package incorrectly validates PeerRecord envelopes, allowing attackers to inject fraudulent, certified addresses into the records of victim peers.","title":"Certified Address Hijacking in libp2p PeerStore","url":"https://feed.craftedsignal.io/briefs/2026-09-libp2p-peer-store-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-86039","version":"https://jsonfeed.org/version/1.1"}