The vulnerability allows an entity that can send Gossipsub control messages to inject oversized IHAVE or IWANT arrays that cause the node to process each element synchronously. This loop can handle roughly 180,000 identifiers in a 4 MB frame, consuming a large amount of CPU time and blocking the Node.js event loop, which results in a denial‑of‑service of the application. This weakness is classified as CWE‑770. The attack leads to loss of availability but does not compromise data confidentiality or integrity.

All installations of the libp2p JavaScript library that use the default @libp2p/gossipsub plugin before version 16.0.0 are affected. This includes projects that import libp2p:js-libp2p or downstream modules that rely on it for peer‑to‑peer messaging. Only releases prior to v16.0.0 of the gossipsub component contain the unbounded decoding limits that allow the attack.

The CVSS score of 7.5 indicates a moderate‑to‑high availability impact while the EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote: based on the description it is inferred that an adversary who can establish a Gossipsub connection can transmit an oversized IHAVE or IWANT message. The exploit requires no privileged state or special access, which means any peer that connects to the vulnerable node could initiate the denial‑of‑service.