CVE-2026-77384: libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libp2p/@libp2p/circuit-relay-v2 relay servers (reservation-store.ts)to a version that resolves this vulnerability.Fixed in 4.2.9
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments running @libp2p/circuit-relay-v2 relay servers are exposed if they use a version prior to 4.2.9. The issue affects the reservation refresh path.
What does an attacker need to do to trigger the resource exhaustion?
A remote peer can repeatedly send valid RESERVE requests for the same reservation. No privileges or user interaction are required.
What is the impact of repeated reservation refreshes?
Each refresh registers another abort listener on the reused retimeableSignal, causing unbounded listener and closure growth. This can exhaust relay-server resources and cause denial of service.
What version resolves the issue?
Upgrade the affected circuit relay v2 component to version 4.2.9, which fixes the reservation refresh listener leak.