An unauthenticated remote peer can send an unbounded stream of PUT_VALUE messages to a @libp2p/kad-dht node running in server mode, causing the node’s datastore to fill until the host disk is exhausted. This results in the node becoming unavailable. The weakness stems from input validation failures (CWE-20) and uncontrolled resource consumption (CWE-400).

The vulnerability affects the libp2p:js-libp2p implementation, specifically any @libp2p/kad-dht node in server mode before version 16.2.6. Users running older versions are at risk.

The CVSS score of 7.5 indicates high severity, and because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the empirical exploitation likelihood is unclear. However, the vulnerability can be exercised by any remote peer without authentication or prior relationship, making it potentially exploitable in open or poorly segmented networks. Once exploited, the attacker can exhaust disk space and crash the node, providing a denial‑of‑service attack vector.