Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@libp2p/kad-dht

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    @libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

    CVE-2026-45783 · GHSA-32mq-hpph-xfvr

    Affected
    • npm @libp2p/kad-dht < 16.2.6
    Fixed in
    16.2.6· Vendor fix available
    Issue
    An unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUTVALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. Details Two cooperating defects combine to produce the vulnerability. Defect 1: verifyRecord silent early-return (packages/kad-dht/src/record/validators.ts:19-21) Legitimate DHT keys (/pk/<multihash, /ipns/<peerId) have exactly 3 slash-delimited parts and are routed to registered validators. Any key whose UTF-8 representation splits into fewer than 3 parts, single-byte keys, or any value without two / characters, thus, bypasses validation entirely and is written to the datastore unconditionally. There is no audit log and no error returned to the caller. Defect 2: Unbounded RPC…

    Recommended action: Upgrade to 16.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →