CVE-2026-45783: libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

Synopsis

Unvalidated PUT_VALUE records in libp2p's JavaScript implementation allow an unauthenticated remote peer to flood the disk storage of any @libp2p/kad-dht node running in server mode. The attack is reachable over the network with no credentials, no prior relationship, and no protocol deviation beyond a crafted key. A successful attack fills the node's datastore until the host disk is exhausted, rendering the node unavailable. A patched-image rebuild at version 16.2.6 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target node's kad-dht server port over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials, account, or prior relationship with the target node are required to send PUT_VALUE messages.

• Victim interactionNot required

  The attack is fully automated against the listening service; no user needs to click, open, or approve anything.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker simply sends a crafted stream of PUT_VALUE messages with keys that bypass content validation, with no race conditions or memory-layout dependencies.

Blast Radius

• Fills the host disk of the targeted kad-dht server node until no free space remains.
• Crashes or stalls the affected libp2p node, making it unable to participate in the DHT overlay network.
• Any other services or processes sharing the same host disk become unable to write data, which can cascade into broader host instability.