Denial of Service in ipfs-bitswap
Summary
GHSA-6fcr-9h9g-23fq: Denial of Service in ipfs-bitswap. Affects ipfs-bitswap versions < 0.24.1. Fixed in 0.24.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ipfs-bitswap package is an npm package that is used for exchanging blocks between IPFS nodes. It is an essential component of the InterPlanetary File System (IPFS) protocol. The package allows nodes to request and share blocks of data with each other, enabling efficient and decentralized file sharing. However, versions of ipfs-bitswap prior to 0.24.1 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in ipfs-bitswap arises from the package's behavior of putting unwanted blocks in the blockstore. This can be exploited in specific conditions to exhaust system resources, leading to a Denial of Service. An attacker could potentially flood a node with a large number of unwanted blocks, causing the node to consume excessive memory or CPU resources and become unresponsive. This vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 20.0.2 as of 23 Oct 2026
npm install ipfs-bitswap@20.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.24.1
This is the first release that contains the fix.
npm install ipfs-bitswap@0.24.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The ipfs-bitswap package prior to version 0.24.1 is vulnerable to a Denial of Service attack. It is crucial to upgrade to the latest version to mitigate the risk of resource exhaustion and ensure the stability and reliability of IPFS nodes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipfs-bitswap →
FAQ
ipfs-bitswap is an npm package used for exchanging blocks between IPFS nodes in a decentralized file sharing network.
A Denial of Service attack is a malicious attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of unwanted requests or data, causing it to become unresponsive.
The vulnerability in ipfs-bitswap can be exploited to exhaust system resources, potentially leading to system slowdown or unresponsiveness.
This vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
To protect your system, it is recommended to upgrade to version 0.24.1 or later of the ipfs-bitswap package.
