Nimiq network-libp2p Crash Vulnerability: CVE-2026-34063

The National Vulnerability Database has detailed CVE-2026-34063, a high-severity vulnerability (CVSS 7.5) affecting Nimiq’s network-libp2p prior to version 1.3.0. This component, an implementation of the Nimiq network based on libp2p, uses a ConnectionHandler state machine for discovery. The critical flaw lies in its assumption of a single inbound and outbound discovery substream per connection.

Should a remote peer initiate the discovery protocol substream a second time on the same connection, the handler fails catastrophically with a panic, specifically “Inbound already connected” or “Outbound already connected.” This isn’t a graceful failure; it crashes the node’s P2P networking task (the swarm), effectively taking the node offline until it’s manually restarted. The National Vulnerability Database states no known workarounds are available, making patching the only viable defense.

This is a denial-of-service vector that’s trivial to exploit from an attacker’s perspective — no authentication, no complex pre-conditions. For any organization running Nimiq nodes, this means an unpatched system is a single malicious connection away from being knocked offline. The fix is included in v1.3.0, so updating is paramount to maintaining network stability and availability.