Homepage

@libp2p/peer-store@12.0.24-d9292b690

Stores information about peers libp2p knows on the network

  • latest version

    12.0.32

  • latest non vulnerable version

    12.0.32

  • first published

    4 years ago

  • latest version published

    6 hours ago

  • licenses detected

  • View peer-store package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @libp2p/peer-store package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    User Impersonation

    @libp2p/peer-store is a Stores information about peers libp2p knows on the network

    Affected versions of this package are vulnerable to User Impersonation via consumePeerRecord in peer-store/src/index.ts, where the peer ID derived from the envelope's signing public key is compared against sequence numbers but addresses are stored under the peer ID taken from the record payload. Because the two peer IDs are never checked for equality, an attacker can supply a peer record whose payload peer ID differs from the signing key's peer ID, causing addresses to be written under an arbitrary peer ID and overwriting legitimate address records for that peer.

    How to fix User Impersonation?

    Upgrade @libp2p/peer-store to version 12.0.24 or higher.

    >=8.0.0 <12.0.24
    Go back to all versions of this package