@aztec/p2p 4.0.0-nightly.20260113 → 4.0.0-nightly.20260114

package/dest/services/reqresp/constants.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Constants for P2P message deserialization bounds checking.
+ * These constants define maximum allowed sizes during deserialization
+ * to prevent DoS attacks via maliciously crafted messages.
+ */
+/** Max transactions per block for deserialization validation (~300x default of 32) */
+export { MAX_TXS_PER_BLOCK } from '@aztec/stdlib/deserialization';
+/** Max version string length (e.g., "1.0.0-alpha.123") */
+export declare const MAX_VERSION_STRING_LENGTH = 64;
+/** Max block hash string length (hex: 0x + 64 chars, with generous headroom) */
+export declare const MAX_BLOCK_HASH_STRING_LENGTH = 128;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc2VydmljZXMvcmVxcmVzcC9jb25zdGFudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7R0FJRztBQUVILHNGQUFzRjtBQUN0RixPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUVsRSwwREFBMEQ7QUFDMUQsZUFBTyxNQUFNLHlCQUF5QixLQUFLLENBQUM7QUFFNUMsZ0ZBQWdGO0FBQ2hGLGVBQU8sTUFBTSw0QkFBNEIsTUFBTSxDQUFDIn0=

package/dest/services/reqresp/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/services/reqresp/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,sFAAsF;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,MAAM,CAAC"}

package/dest/services/reqresp/constants.js

@@ -0,0 +1,7 @@
+/**
+ * Constants for P2P message deserialization bounds checking.
+ * These constants define maximum allowed sizes during deserialization
+ * to prevent DoS attacks via maliciously crafted messages.
+ */ /** Max transactions per block for deserialization validation (~300x default of 32) */ export { MAX_TXS_PER_BLOCK } from '@aztec/stdlib/deserialization';
+/** Max version string length (e.g., "1.0.0-alpha.123") */ export const MAX_VERSION_STRING_LENGTH = 64;
+/** Max block hash string length (hex: 0x + 64 chars, with generous headroom) */ export const MAX_BLOCK_HASH_STRING_LENGTH = 128;

package/dest/services/reqresp/protocols/block_txs/bitvector.d.ts

@@ -27,4 +27,4 @@ export declare class BitVector {
     static fromBuffer(buffer: Buffer | BufferReader): BitVector;
     static byteLength(length: number): number;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYml0dmVjdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvc2VydmljZXMvcmVxcmVzcC9wcm90b2NvbHMvYmxvY2tfdHhzL2JpdHZlY3Rvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsWUFBWSxFQUFxQixNQUFNLDZCQUE2QixDQUFDO0FBRTlFOztHQUVHO0FBQ0gscUJBQWEsU0FBUztJQUNwQixPQUFPLENBQUMsTUFBTSxDQUFTO0lBQ3ZCLE9BQU8sQ0FBQyxNQUFNLENBQVM7SUFFdkIsWUFBWSxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBR3pDO0lBU0QsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxTQUFTLENBbUJ4RDtJQUVELFNBQVMsSUFBSSxNQUFNLENBRWxCO0lBU0QsS0FBSyxDQUFDLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUU1QjtJQUVEOztTQUVLO0lBQ0wsY0FBYyxJQUFJLE1BQU0sRUFBRSxDQUV6QjtJQUVEOzs7O1NBSUs7SUFDTCxRQUFRLElBQUksTUFBTSxDQUVqQjtJQUVEOzs7O1NBSUs7SUFDTCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsWUFBWSxHQUFHLFNBQVMsQ0FNMUQ7SUFFRCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLFVBRS9CO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYml0dmVjdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvc2VydmljZXMvcmVxcmVzcC9wcm90b2NvbHMvYmxvY2tfdHhzL2JpdHZlY3Rvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsWUFBWSxFQUFxQixNQUFNLDZCQUE2QixDQUFDO0FBSTlFOztHQUVHO0FBQ0gscUJBQWEsU0FBUztJQUNwQixPQUFPLENBQUMsTUFBTSxDQUFTO0lBQ3ZCLE9BQU8sQ0FBQyxNQUFNLENBQVM7SUFFdkIsWUFBWSxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBR3pDO0lBU0QsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsR0FBRyxTQUFTLENBbUJ4RDtJQUVELFNBQVMsSUFBSSxNQUFNLENBRWxCO0lBU0QsS0FBSyxDQUFDLEtBQUssRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUU1QjtJQUVEOztTQUVLO0lBQ0wsY0FBYyxJQUFJLE1BQU0sRUFBRSxDQUV6QjtJQUVEOzs7O1NBSUs7SUFDTCxRQUFRLElBQUksTUFBTSxDQUVqQjtJQUVEOzs7O1NBSUs7SUFDTCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsWUFBWSxHQUFHLFNBQVMsQ0FhMUQ7SUFFRCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLFVBRS9CO0NBQ0YifQ==

package/dest/services/reqresp/protocols/block_txs/bitvector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitvector.d.ts","sourceRoot":"","sources":["../../../../../src/services/reqresp/protocols/block_txs/bitvector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAE9E;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;IAEvB,YAAY,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAGzC;IASD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,CAmBxD;IAED,SAAS,IAAI,MAAM,CAElB;IASD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5B;IAED;;SAEK;IACL,cAAc,IAAI,MAAM,EAAE,CAEzB;IAED;;;;SAIK;IACL,QAAQ,IAAI,MAAM,CAEjB;IAED;;;;SAIK;IACL,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM1D;IAED,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,UAE/B;CACF"}
+{"version":3,"file":"bitvector.d.ts","sourceRoot":"","sources":["../../../../../src/services/reqresp/protocols/block_txs/bitvector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAI9E;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;IAEvB,YAAY,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAGzC;IASD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,CAmBxD;IAED,SAAS,IAAI,MAAM,CAElB;IASD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5B;IAED;;SAEK;IACL,cAAc,IAAI,MAAM,EAAE,CAEzB;IAED;;;;SAIK;IACL,QAAQ,IAAI,MAAM,CAEjB;IAED;;;;SAIK;IACL,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAa1D;IAED,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,UAE/B;CACF"}

package/dest/services/reqresp/protocols/block_txs/bitvector.js

@@ -1,4 +1,5 @@
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
+import { MAX_TXS_PER_BLOCK } from '../../constants.js';
 /**
  * BitVector helper class for representing and serializing bit vectors
  */ export class BitVector {
@@ -66,6 +67,12 @@ import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
    * */ static fromBuffer(buffer) {
         const reader = BufferReader.asReader(buffer);
         const length = reader.readNumber();
+        if (length < 0) {
+            throw new Error(`BitVector length ${length} cannot be negative`);
+        }
+        if (length > MAX_TXS_PER_BLOCK) {
+            throw new Error(`BitVector length ${length} exceeds maximum ${MAX_TXS_PER_BLOCK}`);
+        }
         const bitBuffer = reader.readBytes(BitVector.byteLength(length));
         return new BitVector(bitBuffer, length);
     }

package/dest/services/reqresp/protocols/status.d.ts

@@ -39,4 +39,4 @@ export declare class StatusMessage {
  * @returns Status message handler
  */
 export declare function reqRespStatusHandler(compressedComponentsVersion: string, worldStateSynchronizer: WorldStateSynchronizer, logger?: Logger): (peerId: PeerId, _msg: Buffer<ArrayBufferLike>) => Promise<Buffer<ArrayBufferLike>>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RhdHVzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvc2VydmljZXMvcmVxcmVzcC9wcm90b2NvbHMvc3RhdHVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUU5RCxPQUFPLEtBQUssRUFBRSxNQUFNLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUNwRCxPQUFPLEVBQUUsWUFBWSxFQUFxQixNQUFNLDZCQUE2QixDQUFDO0FBRTlFLE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLHNCQUFzQixFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFFcEcsT0FBTyxLQUFLLEVBQUUsTUFBTSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFRaEQscUJBQWEsYUFBYTtJQUV0QixRQUFRLENBQUMsMkJBQTJCLEVBQUUsTUFBTTtJQUM1QyxRQUFRLENBQUMsaUJBQWlCLEVBQUUsV0FBVztJQUN2QyxRQUFRLENBQUMsZUFBZSxFQUFFLE1BQU07SUFDaEMsUUFBUSxDQUFDLG9CQUFvQixFQUFFLFdBQVc7SUFKNUMsWUFDVywyQkFBMkIsRUFBRSxNQUFNLEVBQ25DLGlCQUFpQixFQUFFLFdBQVcsRUFDOUIsZUFBZSxFQUFFLE1BQU0sRUFDdkIsb0JBQW9CLEVBQUUsV0FBVyxFQUkzQztJQUVEOzs7O09BSUc7SUFDSCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsWUFBWSxHQUFHLGFBQWEsQ0FVOUQ7SUFFRDs7O09BR0c7SUFDSCxRQUFRLDRCQVNQO0lBRUQ7Ozs7O09BS0c7SUFDSCxNQUFNLENBQUMsd0JBQXdCLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsb0JBQW9CLEdBQUcsYUFBYSxDQVFoRztJQUVELE1BQU0sQ0FBQyxNQUFNLElBQUksYUFBYSxDQVE3QjtJQUVELFFBQVEsQ0FBQyxVQUFVLEVBQUUsYUFBYSxHQUFHLE9BQU8sQ0FHM0M7SUFFRCxNQUFNLENBQUMsS0FBSyxFQUFFLGFBQWEsR0FBRyxPQUFPLENBT3BDO0NBQ0Y7QUFFRDs7Ozs7O0dBTUc7QUFDSCx3QkFBZ0Isb0JBQW9CLENBQ2xDLDJCQUEyQixFQUFFLE1BQU0sRUFDbkMsc0JBQXNCLEVBQUUsc0JBQXNCLEVBQzlDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sdUZBWWhCIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RhdHVzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvc2VydmljZXMvcmVxcmVzcC9wcm90b2NvbHMvc3RhdHVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUU5RCxPQUFPLEtBQUssRUFBRSxNQUFNLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUNwRCxPQUFPLEVBQUUsWUFBWSxFQUFxQixNQUFNLDZCQUE2QixDQUFDO0FBRTlFLE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLHNCQUFzQixFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFFcEcsT0FBTyxLQUFLLEVBQUUsTUFBTSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFVaEQscUJBQWEsYUFBYTtJQUV0QixRQUFRLENBQUMsMkJBQTJCLEVBQUUsTUFBTTtJQUM1QyxRQUFRLENBQUMsaUJBQWlCLEVBQUUsV0FBVztJQUN2QyxRQUFRLENBQUMsZUFBZSxFQUFFLE1BQU07SUFDaEMsUUFBUSxDQUFDLG9CQUFvQixFQUFFLFdBQVc7SUFKNUMsWUFDVywyQkFBMkIsRUFBRSxNQUFNLEVBQ25DLGlCQUFpQixFQUFFLFdBQVcsRUFDOUIsZUFBZSxFQUFFLE1BQU0sRUFDdkIsb0JBQW9CLEVBQUUsV0FBVyxFQUkzQztJQUVEOzs7O09BSUc7SUFDSCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsWUFBWSxHQUFHLGFBQWEsQ0FVOUQ7SUFFRDs7O09BR0c7SUFDSCxRQUFRLDRCQVNQO0lBRUQ7Ozs7O09BS0c7SUFDSCxNQUFNLENBQUMsd0JBQXdCLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsb0JBQW9CLEdBQUcsYUFBYSxDQVFoRztJQUVELE1BQU0sQ0FBQyxNQUFNLElBQUksYUFBYSxDQVE3QjtJQUVELFFBQVEsQ0FBQyxVQUFVLEVBQUUsYUFBYSxHQUFHLE9BQU8sQ0FHM0M7SUFFRCxNQUFNLENBQUMsS0FBSyxFQUFFLGFBQWEsR0FBRyxPQUFPLENBT3BDO0NBQ0Y7QUFFRDs7Ozs7O0dBTUc7QUFDSCx3QkFBZ0Isb0JBQW9CLENBQ2xDLDJCQUEyQixFQUFFLE1BQU0sRUFDbkMsc0JBQXNCLEVBQUUsc0JBQXNCLEVBQzlDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sdUZBWWhCIn0=

package/dest/services/reqresp/protocols/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../../src/services/reqresp/protocols/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAE9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEpG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAQhD,qBAAa,aAAa;IAEtB,QAAQ,CAAC,2BAA2B,EAAE,MAAM;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,WAAW;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM;IAChC,QAAQ,CAAC,oBAAoB,EAAE,WAAW;IAJ5C,YACW,2BAA2B,EAAE,MAAM,EACnC,iBAAiB,EAAE,WAAW,EAC9B,eAAe,EAAE,MAAM,EACvB,oBAAoB,EAAE,WAAW,EAI3C;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,CAU9D;IAED;;;OAGG;IACH,QAAQ,4BASP;IAED;;;;;OAKG;IACH,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,aAAa,CAQhG;IAED,MAAM,CAAC,MAAM,IAAI,aAAa,CAQ7B;IAED,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAG3C;IAED,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAOpC;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,2BAA2B,EAAE,MAAM,EACnC,sBAAsB,EAAE,sBAAsB,EAC9C,MAAM,CAAC,EAAE,MAAM,uFAYhB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../../src/services/reqresp/protocols/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAE9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEpG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAUhD,qBAAa,aAAa;IAEtB,QAAQ,CAAC,2BAA2B,EAAE,MAAM;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,WAAW;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM;IAChC,QAAQ,CAAC,oBAAoB,EAAE,WAAW;IAJ5C,YACW,2BAA2B,EAAE,MAAM,EACnC,iBAAiB,EAAE,WAAW,EAC9B,eAAe,EAAE,MAAM,EACvB,oBAAoB,EAAE,WAAW,EAI3C;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,CAU9D;IAED;;;OAGG;IACH,QAAQ,4BASP;IAED;;;;;OAKG;IACH,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,aAAa,CAQhG;IAED,MAAM,CAAC,MAAM,IAAI,aAAa,CAQ7B;IAED,QAAQ,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAG3C;IAED,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAOpC;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,2BAA2B,EAAE,MAAM,EACnC,sBAAsB,EAAE,sBAAsB,EAC9C,MAAM,CAAC,EAAE,MAAM,uFAYhB"}

package/dest/services/reqresp/protocols/status.js

@@ -2,6 +2,7 @@ import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Buffer32 } from '@aztec/foundation/buffer';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 import { bufferToHex } from '@aztec/foundation/string';
+import { MAX_BLOCK_HASH_STRING_LENGTH, MAX_VERSION_STRING_LENGTH } from '../constants.js';
 /*
  * P2P Status Message
  * It is used to establish Status handshake between to peers
@@ -26,7 +27,7 @@ import { bufferToHex } from '@aztec/foundation/string';
    * @returns An instance of StatusMessage.
    */ static fromBuffer(buffer) {
         const reader = BufferReader.asReader(buffer);
-        return new StatusMessage(reader.readString(), BlockNumber(reader.readNumber()), reader.readString(), BlockNumber(reader.readNumber()));
+        return new StatusMessage(reader.readString(MAX_VERSION_STRING_LENGTH), BlockNumber(reader.readNumber()), reader.readString(MAX_BLOCK_HASH_STRING_LENGTH), BlockNumber(reader.readNumber()));
     }
     /**
    * Serializes the StatusMessage object into a Buffer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/p2p",
-  "version": "4.0.0-nightly.20260113",
+  "version": "4.0.0-nightly.20260114",
   "type": "module",
   "exports": {
     ".": "./dest/index.js",
@@ -67,17 +67,17 @@
     ]
   },
   "dependencies": {
-    "@aztec/constants": "4.0.0-nightly.20260113",
-    "@aztec/epoch-cache": "4.0.0-nightly.20260113",
-    "@aztec/ethereum": "4.0.0-nightly.20260113",
-    "@aztec/foundation": "4.0.0-nightly.20260113",
-    "@aztec/kv-store": "4.0.0-nightly.20260113",
-    "@aztec/noir-contracts.js": "4.0.0-nightly.20260113",
-    "@aztec/noir-protocol-circuits-types": "4.0.0-nightly.20260113",
-    "@aztec/protocol-contracts": "4.0.0-nightly.20260113",
-    "@aztec/simulator": "4.0.0-nightly.20260113",
-    "@aztec/stdlib": "4.0.0-nightly.20260113",
-    "@aztec/telemetry-client": "4.0.0-nightly.20260113",
+    "@aztec/constants": "4.0.0-nightly.20260114",
+    "@aztec/epoch-cache": "4.0.0-nightly.20260114",
+    "@aztec/ethereum": "4.0.0-nightly.20260114",
+    "@aztec/foundation": "4.0.0-nightly.20260114",
+    "@aztec/kv-store": "4.0.0-nightly.20260114",
+    "@aztec/noir-contracts.js": "4.0.0-nightly.20260114",
+    "@aztec/noir-protocol-circuits-types": "4.0.0-nightly.20260114",
+    "@aztec/protocol-contracts": "4.0.0-nightly.20260114",
+    "@aztec/simulator": "4.0.0-nightly.20260114",
+    "@aztec/stdlib": "4.0.0-nightly.20260114",
+    "@aztec/telemetry-client": "4.0.0-nightly.20260114",
     "@chainsafe/libp2p-gossipsub": "13.0.0",
     "@chainsafe/libp2p-noise": "^15.0.0",
     "@chainsafe/libp2p-yamux": "^6.0.2",
@@ -104,8 +104,8 @@
     "xxhash-wasm": "^1.1.0"
   },
   "devDependencies": {
-    "@aztec/archiver": "4.0.0-nightly.20260113",
-    "@aztec/world-state": "4.0.0-nightly.20260113",
+    "@aztec/archiver": "4.0.0-nightly.20260114",
+    "@aztec/world-state": "4.0.0-nightly.20260114",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^22.15.17",

package/src/services/reqresp/constants.ts

@@ -0,0 +1,14 @@
+/**
+ * Constants for P2P message deserialization bounds checking.
+ * These constants define maximum allowed sizes during deserialization
+ * to prevent DoS attacks via maliciously crafted messages.
+ */
+
+/** Max transactions per block for deserialization validation (~300x default of 32) */
+export { MAX_TXS_PER_BLOCK } from '@aztec/stdlib/deserialization';
+
+/** Max version string length (e.g., "1.0.0-alpha.123") */
+export const MAX_VERSION_STRING_LENGTH = 64;
+
+/** Max block hash string length (hex: 0x + 64 chars, with generous headroom) */
+export const MAX_BLOCK_HASH_STRING_LENGTH = 128;

package/src/services/reqresp/protocols/block_txs/bitvector.ts

@@ -1,5 +1,7 @@
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import { MAX_TXS_PER_BLOCK } from '../../constants.js';
+
 /**
  * BitVector helper class for representing and serializing bit vectors
  */
@@ -80,6 +82,13 @@ export class BitVector {
     const reader = BufferReader.asReader(buffer);
     const length = reader.readNumber();
 
+    if (length < 0) {
+      throw new Error(`BitVector length ${length} cannot be negative`);
+    }
+    if (length > MAX_TXS_PER_BLOCK) {
+      throw new Error(`BitVector length ${length} exceeds maximum ${MAX_TXS_PER_BLOCK}`);
+    }
+
     const bitBuffer = reader.readBytes(BitVector.byteLength(length));
     return new BitVector(bitBuffer, length);
   }

package/src/services/reqresp/protocols/status.ts

@@ -7,6 +7,8 @@ import type { WorldStateSyncStatus, WorldStateSynchronizer } from '@aztec/stdlib
 
 import type { PeerId } from '@libp2p/interface';
 
+import { MAX_BLOCK_HASH_STRING_LENGTH, MAX_VERSION_STRING_LENGTH } from '../constants.js';
+
 /*
  * P2P Status Message
  * It is used to establish Status handshake between to peers
@@ -32,12 +34,12 @@ export class StatusMessage {
   static fromBuffer(buffer: Buffer | BufferReader): StatusMessage {
     const reader = BufferReader.asReader(buffer);
     return new StatusMessage(
-      reader.readString(), // compressedComponentsVersion
+      reader.readString(MAX_VERSION_STRING_LENGTH), // compressedComponentsVersion
       BlockNumber(reader.readNumber()), // latestBlockNumber
-      reader.readString(), // latestBlockHash
+      reader.readString(MAX_BLOCK_HASH_STRING_LENGTH), // latestBlockHash
       BlockNumber(reader.readNumber()), // finalizedBlockNumber
       //TODO: add finalizedBlockHash
-      //reader.readString(), // finalizedBlockHash
+      //reader.readString(MAX_BLOCK_HASH_STRING_LENGTH), // finalizedBlockHash
     );
   }