What’s Vulnerable › Vulnerabilities

CVE-2026-45783: libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-07-23
• Weakness: CWE-20

Description

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.

Affected products

• libp2p js-libp2p: before 16.2.6

References

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr

Get alerted when CVE-2026-45783 or the next vulnerability affects your stack