CVE-2026-45783

Summary

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.

Affected Software

Weaknesses

• CWE-20: CWE-20: Improper Input Validation
• CWE-400: CWE-400: Uncontrolled Resource Consumption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr

References

• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr

• ←Previous
• Next→