CVE-2026-45783: @libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

May 19, 2026 (updated June 11, 2026)

An unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node’s datastore fills until the host disk is exhausted, making the node unavailable.

References

github.com/advisories/GHSA-32mq-hpph-xfvr
github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr
nvd.nist.gov/vuln/detail/CVE-2026-45783

Code Behaviors & Features

Detect and mitigate CVE-2026-45783 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →