Identity Spoofing in libp2p-secio
Summary
GHSA-rch7-f4h5-x9rj: Identity Spoofing in libp2p-secio. Affects libp2p-secio versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libp2p-secio is an npm package that provides secure communication channels for libp2p, a modular network stack for peer-to-peer applications. It is used to establish secure connections between peers by performing a crypto handshake. However, certain versions of libp2p-secio are affected by a vulnerability that allows identity spoofing. This means that the package does not correctly verify the PeerId of the destination peer, leading to a high severity security issue.
Vulnerability Detail
The vulnerability in libp2p-secio arises from the failure to properly validate the PeerId of the destination peer during the crypto handshake. This allows an attacker to spoof their identity and impersonate another peer. By exploiting this vulnerability, an attacker could potentially gain unauthorized access to sensitive information or perform malicious actions on the network. The severity of this vulnerability is rated as critical with a CVSS score of 9.1.
How To Fix
Latest published version: 0.13.1 as of 22 Oct 2026
npm install libp2p-secio@0.13.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
npm install libp2p-secio@0.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The libp2p-secio package is affected by a critical vulnerability that allows identity spoofing. To mitigate this issue, it is crucial to update to version 0.9.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libp2p-secio →
FAQ
libp2p-secio is an npm package that provides secure communication channels for libp2p, a modular network stack for peer-to-peer applications.
The vulnerability allows identity spoofing, enabling an attacker to impersonate another peer and potentially gain unauthorized access or perform malicious actions on the network.
The severity of this vulnerability is rated as critical with a CVSS score of 9.1.
To fix this vulnerability, update to version 0.9.0 or later of the libp2p-secio package.
No workaround is available for this vulnerability. Updating to the fixed version is the recommended solution.
