CVE-2026-45783

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) libp2p es una implementación de JavaScript de la pila de red libp2p. Antes de la versión 16.2.6, un par remoto no autenticado puede agotar el almacenamiento en disco de cualquier nodo @libp2p/kad-dht que se ejecute en modo servidor enviando un flujo ilimitado de mensajes PUT_VALUE cuyas claves eluden toda validación de contenido. No se requieren credenciales, ninguna relación previa y ninguna desviación del protocolo más allá de una clave manipulada. El almacén de datos del nodo víctima se llena hasta que el disco del host se agota, lo que hace que el nodo no esté disponible. Este problema ha sido parcheado en la versión 16.2.6.

11 Jun 2026, 17:16

Type	Values Removed	Values Added
References	~~() https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr -~~	() https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr -

10 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-45783

Mitre link : CVE-2026-45783

CVE.ORG link : CVE-2026-45783

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-45783", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45783", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T13:51:51.378568Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "libp2p", "product": "js-libp2p", "versions": [{"status": "affected", "version": "< 16.2.6"}]}]}], "published": "2026-06-10T22:16:59.053", "references": [{"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr", "source": "security-advisories@github.com"}, {"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6."}, {"lang": "es", "value": "libp2p es una implementaci\u00f3n de JavaScript de la pila de red libp2p. Antes de la versi\u00f3n 16.2.6, un par remoto no autenticado puede agotar el almacenamiento en disco de cualquier nodo @libp2p/kad-dht que se ejecute en modo servidor enviando un flujo ilimitado de mensajes PUT_VALUE cuyas claves eluden toda validaci\u00f3n de contenido. No se requieren credenciales, ninguna relaci\u00f3n previa y ninguna desviaci\u00f3n del protocolo m\u00e1s all\u00e1 de una clave manipulada. El almac\u00e9n de datos del nodo v\u00edctima se llena hasta que el disco del host se agota, lo que hace que el nodo no est\u00e9 disponible. Este problema ha sido parcheado en la versi\u00f3n 16.2.6."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security-advisories@github.com"}