Vulnerability details

CVE-2026-45783

libp2p js-libp2p

libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

CVSS 3.1

7.5High

Official description

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
libp2p	js-libp2p	< 16.2.6	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-11
Last updated: 2026-06-11
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.35%

Probability of exploitation in 30 days

29.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-20
Improper Input Validation
CWE-400
Uncontrolled Resource Consumption