CVE-2026-45783
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in the libp2p JavaScript library allows an unauthenticated remote attacker to exhaust disk storage of any @libp2p/kad-dht node running in server mode. The attack sends an unbounded stream of PUT_VALUE messages with keys that bypass content validation.
Risk Assessment
Disk exhaustion leads to node unavailability, potentially disrupting the entire P2P network and causing data loss.
Recommendation
Update @libp2p/kad-dht to version 16.2.6 or later, which includes the fix.
Other vulnerabilities in libp2p
See all- CVE-2026-77384High
Vulnerability in libp2p (JavaScript) before version 4.2.9: the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. A remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service.
- CVE-2026-49866High
A vulnerability in the libp2p JavaScript library prior to version 16.0.0 allowed blocking the Node.js event loop by sending specially crafted IHAVE and IWANT messages. Missing limits in defaultDecodeRpcLimits (maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity) enabled iterating approximately 180,000 message IDs per 4 MB frame, leading to denial of service (DoS).
Original NVD description (English source)
libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.