# CVE-2026-45783: libp2p @libp2p/kad-dht Disk Exhaustion via Unvalidated PUT_VALUE Records

Source: https://junglewise.ai/threats/cve-2026-45783-libp2p-libp2p-kad-dht-disk-exhaustion-via-unvalidated-put-value  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45783 · Severity: high · CVSS 7.5 · Published 2026-06-10

The @libp2p/kad-dht library is a distributed hash table (DHT) component used in peer-to-peer networking applications. An unauthenticated attacker can crash any DHT server node by flooding it with specially crafted PUT_VALUE messages that bypass validation and fill the disk with invalid data, rendering the node unavailable.

Vendors: [Libp2p](https://junglewise.ai/threats/vendors/libp2p), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-45783 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45783 being exploited in the wild.

**How severe is CVE-2026-45783?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** Libp2p Kad-Dht < 16.2.6, <= 16.2.4, ≤ 16.2.4; @libp2p/kad-dht (npm) < 16.2.6, SEMVER:introduced=0,fixed=16.2.6.

**Is there a fix for CVE-2026-45783?** Yes. @libp2p/kad-dht (npm): upgrade to 16.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45783 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45783?** Check whether you run Libp2p Kad-Dht or @libp2p/kad-dht (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @libp2p/kad-dht (npm): upgrade to 16.2.6 or later

  ```sh
  npm install @libp2p/kad-dht@16.2.6
  ```


## Technical details

The vulnerability stems from two cooperating defects in the JavaScript implementation. First, the verifyRecord function silently succeeds and writes records to the datastore when keys have fewer than 3 slash-delimited parts (after UTF-8 decoding), bypassing validation for legitimate DHT keys (/pk/*, /ipns/*) entirely. Second, the RPC message-handling loop resets its inactivity timeout after every successfully received message with no per-stream message count limit, per-peer byte budget, or rate limiter. An attacker can deliver 4 MB messages repeatedly within the 10-second inactivity window across 32 concurrent streams, achieving unbounded disk exhaustion. No authentication or protocol deviation beyond a crafted key is required; only a standard libp2p TLS handshake is needed. The Go implementation (go-libp2p-kad-dht) is not affected, as it enforces record validation at the RPC layer. A proof-of-concept test is provided in the advisory.

## Affected products

- libp2p @libp2p/kad-dht ≤ 16.2.4

## Identifiers

- CVE-2026-45783
- GHSA-32mq-hpph-xfvr

## Timeline

- 2026-05-19: disclosed: Advisory published
- 2026-05-19: patched: Fix released in version 16.2.6

## References

- [https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr](https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr)
- [https://github.com/libp2p/js-libp2p](https://github.com/libp2p/js-libp2p)