A flaw in the reservation refresh routine of libp2p’s Circuit relay v2 server causes each refresh to add another abort listener to a shared signal. A remote peer can repeatedly send valid RESERVE requests for the same reservation, resulting in unbounded growth of listener objects and eventual exhaustion of server resources. The vulnerability manifests as a classic uncontrolled resource consumption weakness (CWE-400) and an unreleased resource condition (CWE-772). Once triggered, the relay server can become unable to accept new connections or process legitimate traffic, effectively denying service to all relying clients.

Any deployment of the libp2p JavaScript stack that includes the circuit‑relay‑v2 component and was running a version earlier than 4.2.9. The issue is specific to the js‑libp2p library, particularly the reservation‑store module in reservation‑store.ts.

The CVSS score for this weakness is 7.5, indicating a high severity rating. The EPSS value is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, so there is no current evidence of widespread exploitation. However, because the flaw can be triggered remotely by any peer that can send RESERVE traffic, it constitutes a plausible attack vector that can lead to cascading denial of service for the entire relay network.