libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.

CVE-2026-77384 affects the JavaScript implementation of the libp2p networking stack, specifically the @libp2p/circuit-relay-v2 package. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts unconditionally registers an additional abort listener on every RESERVE request refresh without cleaning up previous listeners. A remote peer can exploit this by repeatedly sending valid RESERVE requests for the same reservation, causing unbounded growth of listeners and closures in relay servers. This leads to a denial-of-service condition due to memory exhaustion and resource leakage. The vulnerability requires no special privileges, as any remote peer can send valid RESERVE requests. The fix was introduced in version 4.2.9 of circuit-relay-v2. Patches and a security advisory are available via the official GitHub repository.