The js-libp2p networking library is affected by a high-severity resource exhaustion flaw that can be triggered by unauthenticated remote actors to crash the system.

This vulnerability involves uncontrolled resource consumption and missing release of resources (CWE-400, CWE-772) within the networking stack. It is exploitable by unauthenticated remote attackers via the network vector.

Successful exploitation results in a denial-of-service condition, rendering the affected networking stack unresponsive. Given the CVSS score of 7.5, this poses a significant risk to service availability, particularly for decentralized or peer-to-peer applications relying on this library for connectivity.

Immediate Action: Update js-libp2p to version 4.2.9 or later to incorporate the necessary resource management fixes.

Proactive Monitoring: Monitor node logs for unusual surges in connection attempts or sudden spikes in memory and CPU utilization that may indicate exploitation attempts.

Compensating Controls: Implement rate limiting at the network boundary or application level to restrict the volume of incoming traffic, which may help mitigate the impact of resource exhaustion attacks.

Public Exploit Available: Unknown.

The vulnerability represents a clear risk to the availability of systems using js-libp2p. Administrators should prioritize updating to version 4.2.9 immediately to ensure the stability and security of their networking infrastructure.