Is CVE-2026-45783 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45783 being exploited in the wild.

How severe is CVE-2026-45783?

High severity, with a CVSS score of 7.5, published 10 June 2026.

Which products and versions are affected?

Libp2p Kad-Dht < 16.2.6, <= 16.2.4, ≤ 16.2.4; @libp2p/kad-dht (npm) < 16.2.6, SEMVER:introduced=0,fixed=16.2.6.

Is there a fix for CVE-2026-45783?

Yes. @libp2p/kad-dht (npm): upgrade to 16.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45783 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45783?

Check whether you run Libp2p Kad-Dht or @libp2p/kad-dht (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45783: libp2p @libp2p/kad-dht Disk Exhaustion via Unvalidated PUT_VALUE Records

Q: Which products and versions are affected?

Libp2p Kad-Dht < 16.2.6, <= 16.2.4, ≤ 16.2.4; @libp2p/kad-dht (npm) < 16.2.6, SEMVER:introduced=0,fixed=16.2.6.

Q: Is there a fix for CVE-2026-45783?

Yes. @libp2p/kad-dht (npm): upgrade to 16.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45783 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45783?

Check whether you run Libp2p Kad-Dht or @libp2p/kad-dht (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45783 · Severity: high · CVSS 7.5 · Published 2026-06-10

The @libp2p/kad-dht library is a distributed hash table (DHT) component used in peer-to-peer networking applications. An unauthenticated attacker can crash any DHT server node by flooding it with specially crafted PUT_VALUE messages that bypass validation and fill the disk with invalid data, rendering the node unavailable.

Vendors: Libp2p, npm.

Quick answers

Is CVE-2026-45783 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45783 being exploited in the wild.
How severe is CVE-2026-45783?: High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?: Libp2p Kad-Dht < 16.2.6, <= 16.2.4, ≤ 16.2.4; @libp2p/kad-dht (npm) < 16.2.6, SEMVER:introduced=0,fixed=16.2.6.
Is there a fix for CVE-2026-45783?: Yes. @libp2p/kad-dht (npm): upgrade to 16.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45783 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45783?: Check whether you run Libp2p Kad-Dht or @libp2p/kad-dht (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@libp2p/kad-dht (npm): upgrade to 16.2.6 or later
```
npm install @libp2p/kad-dht@16.2.6
```

Technical details

The vulnerability stems from two cooperating defects in the JavaScript implementation. First, the verifyRecord function silently succeeds and writes records to the datastore when keys have fewer than 3 slash-delimited parts (after UTF-8 decoding), bypassing validation for legitimate DHT keys (/pk/*, /ipns/*) entirely. Second, the RPC message-handling loop resets its inactivity timeout after every successfully received message with no per-stream message count limit, per-peer byte budget, or rate limiter. An attacker can deliver 4 MB messages repeatedly within the 10-second inactivity window across 32 concurrent streams, achieving unbounded disk exhaustion. No authentication or protocol deviation beyond a crafted key is required; only a standard libp2p TLS handshake is needed. The Go implementation (go-libp2p-kad-dht) is not affected, as it enforces record validation at the RPC layer. A proof-of-concept test is provided in the advisory.

Affected products

libp2p @libp2p/kad-dht ≤ 16.2.4

Identifiers

CVE-2026-45783
GHSA-32mq-hpph-xfvr

Timeline

2026-05-19: disclosed: Advisory published
2026-05-19: patched: Fix released in version 16.2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.