7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45783

CVE-2026-45783: libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45783

CVE-2026-45783:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@libp2p/kad-dht	npm	< 16.2.6	16.2.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by a combination of two defects. First, the verifyRecord function in packages/kad-dht/src/record/validators.ts does not properly validate record keys, allowing an attacker to craft a key that bypasses validation. Specifically, if the key has fewer than three slash-separated parts, the function returns silently, and the record is stored without any checks. Second, the onIncomingStream function in packages/kad-dht/src/rpc/index.ts contains an unbounded loop for processing incoming messages. The inactivity timeout is reset after each message, which allows an attacker to send an unlimited number of messages over a single stream. By combining these two vulnerabilities, an attacker can send a large number of PUT_VALUE messages with invalid keys, causing the node's datastore to grow indefinitely, leading to disk exhaustion and a denial of service. The handleMessage function is also implicated as it is the function that processes the messages within the vulnerable loop.

Vulnerable functions

verifyRecord

packages/kad-dht/src/record/validators.ts

This function is vulnerable because it silently returns if the record key has fewer than three slash-separated parts, bypassing validation and allowing unvalidated records to be stored.

onIncomingStream

packages/kad-dht/src/rpc/index.ts

This function contains an unbounded loop that processes incoming messages. The inactivity timeout is reset after each message, allowing an attacker to keep the stream open indefinitely and send an unlimited number of messages, leading to resource exhaustion.

handleMessage

packages/kad-dht/src/rpc/index.ts

This function is called within the unbounded loop in `onIncomingStream` to process each incoming message. It is part of the chain that leads to the storage of unvalidated records.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.