| Package | Affected versions | Patched versions |
|---|---|---|
| js-libp2p-noise | ≥ 5.0.0, < 5.0.3< 4.1.2 | 5.0.34.1.2 |
| @chainsafe/libp2p-noise | ≥ 5.0.0, < 5.0.3< 4.1.2 | 5.0.34.1.2 |
@chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.
This may allow a man-in-the-middle to pose as other peers and get those peers banned.
Users should upgrade to 4.1.2 or 5.0.3
No workarounds, just patch upgrade
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free