{"id":"EUVD-2026-36153","enisaUuid":"25c5fb8b-7108-3c1b-b86f-e17204c19914","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node\u0027s datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.","datePublished":"Jun 10, 2026, 9:09:40 PM","dateUpdated":"Jun 11, 2026, 4:14:58 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr\n","aliases":"CVE-2026-45783\nGHSA-32mq-hpph-xfvr\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"a97e6ac4-45bf-331d-b151-3d09b5cda9d1","product":{"name":"js-libp2p","vendor":{"name":"libp2p"}},"product_version":"\u003c 16.2.6"}],"enisaIdVendor":[{"id":"9bf617a2-e5a1-36c5-a5b7-9b0d5c47ca6f","vendor":{"name":"libp2p"}}],"enisaIdVulnerability":[{"id":"0426acd6-36f5-3fce-86a8-44cff62c94c7","vulnerability":{"id":"GHSA-32mq-hpph-xfvr","description":"@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes","datePublished":"May 19, 2026, 8:07:52 PM","dateUpdated":"Jun 11, 2026, 1:30:45 PM","baseScore":0.0,"references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45783\nhttps://github.com/libp2p/js-libp2p\n","enisa_id":"EUVD-2026-36153\n","aliases":"GHSA-32mq-hpph-xfvr\nCVE-2026-45783\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:48:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"07189f19-1250-3390-9781-ae729b92e3ec","vulnerability":{"id":"CVE-2026-45783","description":"libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node\u0027s datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.","datePublished":"Jun 10, 2026, 9:09:40 PM","dateUpdated":"Jun 11, 2026, 4:14:58 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr\n","enisa_id":"EUVD-2026-36153\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 13, 2026, 7:21:57 AM","vulnerabilityProduct":[{"id":"4efeea2a-c108-349f-b882-64b7ede167b2","product":{"name":"js-libp2p","vendor":{"name":"libp2p"}},"product_version":"\u003c 16.2.6"}],"vulnerabilityVendor":[{"id":"9b2fe770-1ac1-3856-b68c-c7eaeadac337","vendor":{"name":"libp2p"}}]}}],"enisaIdAdvisory":[]}