Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-77384 Denial of Service in libp2p Reservation Refresh Due to Unbounded Listener Growth https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-77384
Post summary
The text announces a new CVE (CVE-2026-77384) describing a denial‑of‑service risk in libp2p’s Reservation Refresh due to unbounded listener growth, but provides no PoC, exploit, active‑use, patch, or false‑positive information.