fix(deps): update yamux to 0.13.10, remove vulnerable 0.12.x (high CVE-2026-32314)

Cargo.toml

@@ -276,3 +276,7 @@ op-alloy = { path = "deps/optimism/rust/op-alloy/crates/op-alloy" }
 # alloy-rpc-types-engine 1.6.3 requires jsonwebtoken ^9.3.0 (^9 semver),
 # which does not include 10.x. This local fork pins jsonwebtoken to 10.3.0.
 alloy-rpc-types-engine = { path = "deps/alloy-rpc-types-engine" }
+# Security patch: remove yamux 0.12.x (CVE-2026-32314) from libp2p-yamux 0.47.0.
+# libp2p-yamux 0.47.0 depends on both yamux 0.12.x (legacy) and 0.13.x (default).
+# This local fork drops yamux012 and uses only yamux 0.13.x (already patched).
+libp2p-yamux = { path = "deps/libp2p-yamux" }

deps/libp2p-yamux/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "libp2p-yamux"
+edition = "2021"
+rust-version = "1.73"
+description = "Yamux multiplexing protocol for libp2p (yamux012 removed for CVE-2026-32314)"
+version = "0.47.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+license = "MIT"
+repository = "https://github.com/libp2p/rust-libp2p"
+keywords = ["peer-to-peer", "libp2p", "networking"]
+categories = ["network-programming", "asynchronous"]
+
+[dependencies]
+either = "1"
+futures = "0.3"
+libp2p-core = "0.43"
+thiserror = "2"
+yamux = { version = "0.13.3", package = "yamux" }
+tracing = "0.1"

deps/libp2p-yamux/src/lib.rs

@@ -0,0 +1,270 @@
+// Copyright 2018 Parity Technologies (UK) Ltd.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+
+//! Implementation of the [Yamux](https://github.com/hashicorp/yamux/blob/master/spec.md) multiplexing protocol for libp2p.
+//!
+//! This is a security-patched fork of libp2p-yamux 0.47.0 that removes the
+//! yamux 0.12.x dependency (CVE-2026-32314) and uses only yamux 0.13.x.
+
+#![cfg_attr(docsrs, feature(doc_cfg, doc_auto_cfg))]
+
+use std::{
+    collections::VecDeque,
+    io,
+    io::{IoSlice, IoSliceMut},
+    iter,
+    pin::Pin,
+    task::{Context, Poll, Waker},
+};
+
+use futures::{prelude::*, ready};
+use libp2p_core::{
+    muxing::{StreamMuxer, StreamMuxerEvent},
+    upgrade::{InboundConnectionUpgrade, OutboundConnectionUpgrade, UpgradeInfo},
+};
+use thiserror::Error;
+
+/// A Yamux connection.
+#[derive(Debug)]
+pub struct Muxer<C> {
+    connection: yamux::Connection<C>,
+    /// Temporarily buffers inbound streams in case our node is
+    /// performing backpressure on the remote.
+    inbound_stream_buffer: VecDeque<Stream>,
+    /// Waker to be called when new inbound streams are available.
+    inbound_stream_waker: Option<Waker>,
+}
+
+/// How many streams to buffer before we start resetting them.
+const MAX_BUFFERED_INBOUND_STREAMS: usize = 256;
+
+impl<C> Muxer<C>
+where
+    C: AsyncRead + AsyncWrite + Send + Unpin + 'static,
+{
+    fn new(connection: yamux::Connection<C>) -> Self {
+        Muxer {
+            connection,
+            inbound_stream_buffer: VecDeque::default(),
+            inbound_stream_waker: None,
+        }
+    }
+}
+
+impl<C> StreamMuxer for Muxer<C>
+where
+    C: AsyncRead + AsyncWrite + Unpin + 'static,
+{
+    type Substream = Stream;
+    type Error = Error;
+
+    #[tracing::instrument(level = "trace", name = "StreamMuxer::poll_inbound", skip(self, cx))]
+    fn poll_inbound(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Result<Self::Substream, Self::Error>> {
+        if let Some(stream) = self.inbound_stream_buffer.pop_front() {
+            return Poll::Ready(Ok(stream));
+        }
+
+        if let Poll::Ready(res) = self.poll_inner(cx) {
+            return Poll::Ready(res);
+        }
+
+        self.inbound_stream_waker = Some(cx.waker().clone());
+        Poll::Pending
+    }
+
+    #[tracing::instrument(level = "trace", name = "StreamMuxer::poll_outbound", skip(self, cx))]
+    fn poll_outbound(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Result<Self::Substream, Self::Error>> {
+        let stream = ready!(self.connection.poll_new_outbound(cx))
+            .map_err(Error)
+            .map(Stream)?;
+        Poll::Ready(Ok(stream))
+    }
+
+    #[tracing::instrument(level = "trace", name = "StreamMuxer::poll_close", skip(self, cx))]
+    fn poll_close(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        self.connection.poll_close(cx).map_err(Error)
+    }
+
+    #[tracing::instrument(level = "trace", name = "StreamMuxer::poll", skip(self, cx))]
+    fn poll(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Result<StreamMuxerEvent, Self::Error>> {
+        let this = self.get_mut();
+
+        let inbound_stream = ready!(this.poll_inner(cx))?;
+
+        if this.inbound_stream_buffer.len() >= MAX_BUFFERED_INBOUND_STREAMS {
+            tracing::warn!(
+                stream=%inbound_stream.0,
+                "dropping stream because buffer is full"
+            );
+            drop(inbound_stream);
+        } else {
+            this.inbound_stream_buffer.push_back(inbound_stream);
+
+            if let Some(waker) = this.inbound_stream_waker.take() {
+                waker.wake()
+            }
+        }
+
+        cx.waker().wake_by_ref();
+        Poll::Pending
+    }
+}
+
+/// A stream produced by the yamux multiplexer.
+#[derive(Debug)]
+pub struct Stream(yamux::Stream);
+
+impl AsyncRead for Stream {
+    fn poll_read(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut [u8],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.0).poll_read(cx, buf)
+    }
+
+    fn poll_read_vectored(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        bufs: &mut [IoSliceMut<'_>],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.0).poll_read_vectored(cx, bufs)
+    }
+}
+
+impl AsyncWrite for Stream {
+    fn poll_write(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.0).poll_write(cx, buf)
+    }
+
+    fn poll_write_vectored(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        bufs: &[IoSlice<'_>],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.0).poll_write_vectored(cx, bufs)
+    }
+
+    fn poll_flush(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.0).poll_flush(cx)
+    }
+
+    fn poll_close(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.0).poll_close(cx)
+    }
+}
+
+impl<C> Muxer<C>
+where
+    C: AsyncRead + AsyncWrite + Unpin + 'static,
+{
+    fn poll_inner(&mut self, cx: &mut Context<'_>) -> Poll<Result<Stream, Error>> {
+        let stream = ready!(self.connection.poll_next_inbound(cx))
+            .ok_or(Error(yamux::ConnectionError::Closed))?
+            .map_err(Error)
+            .map(Stream)?;
+
+        Poll::Ready(Ok(stream))
+    }
+}
+
+/// The yamux configuration.
+#[derive(Debug, Clone)]
+pub struct Config(yamux::Config);
+
+impl Default for Config {
+    fn default() -> Self {
+        let mut cfg = yamux::Config::default();
+        cfg.set_read_after_close(false);
+        Self(cfg)
+    }
+}
+
+impl Config {
+    /// Sets the maximum number of concurrent substreams.
+    pub fn set_max_num_streams(&mut self, num_streams: usize) -> &mut Self {
+        self.0.set_max_num_streams(num_streams);
+        self
+    }
+}
+
+impl UpgradeInfo for Config {
+    type Info = &'static str;
+    type InfoIter = iter::Once<Self::Info>;
+
+    fn protocol_info(&self) -> Self::InfoIter {
+        iter::once("/yamux/1.0.0")
+    }
+}
+
+impl<C> InboundConnectionUpgrade<C> for Config
+where
+    C: AsyncRead + AsyncWrite + Send + Unpin + 'static,
+{
+    type Output = Muxer<C>;
+    type Error = io::Error;
+    type Future = future::Ready<Result<Self::Output, Self::Error>>;
+
+    fn upgrade_inbound(self, io: C, _: Self::Info) -> Self::Future {
+        let connection = yamux::Connection::new(io, self.0, yamux::Mode::Server);
+        future::ready(Ok(Muxer::new(connection)))
+    }
+}
+
+impl<C> OutboundConnectionUpgrade<C> for Config
+where
+    C: AsyncRead + AsyncWrite + Send + Unpin + 'static,
+{
+    type Output = Muxer<C>;
+    type Error = io::Error;
+    type Future = future::Ready<Result<Self::Output, Self::Error>>;
+
+    fn upgrade_outbound(self, io: C, _: Self::Info) -> Self::Future {
+        let connection = yamux::Connection::new(io, self.0, yamux::Mode::Client);
+        future::ready(Ok(Muxer::new(connection)))
+    }
+}
+
+/// The Yamux [`StreamMuxer`] error type.
+#[derive(Debug, Error)]
+#[error(transparent)]
+pub struct Error(yamux::ConnectionError);
+
+impl From<Error> for io::Error {
+    fn from(err: Error) -> Self {
+        match err.0 {
+            yamux::ConnectionError::Io(e) => e,
+            e => io::Error::new(io::ErrorKind::Other, e),
+        }
+    }
+}