CVE-2026-45783: libp2p kad-dht Unauthenticated Denial of Service via Disk Exhaustion

Technical summary

The vulnerability exists in the kad-dht (Kademlia Distributed Hash Table) component of libp2p prior to version 16.2.6. The flaw is rooted in insufficient input validation on PUT_VALUE requests: the node accepts and persists key-value pairs to its datastore without adequate checks on key legitimacy or content bounds. An unauthenticated remote peer can exploit this by sending an unbounded sequence of PUT_VALUE messages containing keys that evade existing validation logic. Because the datastore writes all received pairs to disk without rate limiting or storage quotas, an attacker can fill the host filesystem exhaustively. The vulnerability maps to CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption), reflecting both the validation bypass and the resulting denial-of-service condition.

Business impact

Any organization running libp2p kad-dht nodes in server mode faces potential service disruption. Affected deployments may include decentralized applications, IPFS nodes, or other peer-to-peer systems built on libp2p. An attacker can render nodes offline without warning, degrading network availability and data accessibility. For services relying on kad-dht as a discovery or storage layer, the impact extends to broader application outages. Recovery requires manual intervention to free disk space and restart nodes, introducing operational overhead. Because exploitation requires no authentication or prior compromise, the attack surface is the entire internet for any exposed kad-dht node.

Affected systems

The vulnerability affects @libp2p/kad-dht versions prior to 16.2.6. While the specific npm package (@libp2p/kad-dht) is the direct target, any JavaScript application or service that embeds this library and exposes a kad-dht node in server mode is at risk. This includes IPFS implementations, blockchain nodes using libp2p for peer discovery, and custom decentralized systems. The vulnerability does not require special node configuration—default server-mode deployments are vulnerable. Non-server deployments and applications not using the kad-dht module are unaffected.

Exploitability

Exploitability is high. The attack requires no special privileges, valid peer identity, or prior interaction with the target. An attacker needs only network connectivity to the affected node and the ability to craft and send malformed kad-dht PUT_VALUE messages. The attack is trivial to automate and can be launched at scale against multiple targets. No sophisticated tooling or deep protocol knowledge is required beyond understanding the PUT_VALUE message structure. The CVSS 3.1 score of 7.5 (HIGH) reflects network-adjacent attack vector, low complexity, and no required privileges, though impact is limited to availability rather than confidentiality or integrity.

Remediation

Upgrade @libp2p/kad-dht to version 16.2.6 or later. This patch version includes enhanced input validation on keys within PUT_VALUE messages and likely introduces resource consumption controls (rate limiting, storage quotas, or per-peer limits) to prevent unbounded datastore growth. Organizations should verify upgrade feasibility for their applications, test in staging environments, and plan coordinated deployment to minimize disruption. Until patching is complete, network-level controls (restricting peer connections to trusted sources) provide temporary mitigation but are not a substitute for patching.

Patch guidance

Apply version 16.2.6 or later of @libp2p/kad-dht. Verify the patch through the official npm registry and the libp2p GitHub repository advisory. Test the upgrade in a non-production environment to confirm compatibility with your application and dependent libraries. Review release notes for any breaking changes or configuration updates. After deployment, monitor node logs and disk usage to confirm the fix mitigates the attack surface. For applications with strict uptime requirements, consider a canary or staged rollout approach.

Detection guidance

Monitor affected nodes for sudden increases in disk I/O, datastore growth, or filesystem utilization approaching capacity. Inspect datastore directories for unusual key patterns or abnormally high key counts. Implement alerting on disk space thresholds to catch early signs of the attack. Network-level detection is difficult without deep packet inspection, as the attacker sends valid kad-dht protocol messages; focus on behavioral anomalies at the host level. Log analysis of kad-dht operations may reveal high volumes of PUT_VALUE requests from single or distributed sources. Consider implementing custom metrics or instrumentation in libp2p to expose datastore ingestion rates and peer request patterns.

Why prioritize this

This vulnerability should be prioritized based on your organization's reliance on libp2p kad-dht nodes for critical services. If you operate any public or internet-facing kad-dht nodes (including IPFS daemons, blockchain peers, or decentralized app infrastructure), remediation is urgent. The attack is trivial to execute, requires no authentication, and causes immediate service degradation. Even organizations with moderate exposure should patch within days rather than weeks, given the simplicity of exploitation and the widespread nature of libp2p in decentralized systems. Non-exposed or internal-only deployments can follow a standard maintenance cycle but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability: unauthenticated remote attackers over the network (AV:N) with low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) can achieve high availability impact (A:H). The attack affects only the availability of the service (C:N, I:N, S:U), preventing remote code execution, data theft, or integrity compromise. The scoring is appropriate for a denial-of-service attack that is easy to execute and widely exploitable, though not catastrophic in scope. Organizations with high-availability requirements or critical peer-to-peer infrastructure may treat this as a severity tier higher than the base score suggests.

Frequently asked questions