CVE-2026-45783

7.5 Élevée

Publiée le 11/06/2026 à 00:16 · Modifiée le 23/07/2026 à 11:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The victim node's datastore fills until the host disk is exhausted, making the node unavailable. This issue has been patched in version 16.2.6.

Traduire en français

Produits concernés

libp2p js-libp2p

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-20
CWE-400

Références

https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr
https://github.com/libp2p/js-libp2p/security/advisories/GHSA-32mq-hpph-xfvr

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories