Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@libp2p/kad-dht

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
16.4.9 (Oct 19, 2026): no advisory affects it
Newest unaffected release
16.4.9 (Oct 19, 2026), the latest release
Advisories
1 · 1 high
Weekly downloads
39.6K
Dependents
230
Releases
500+ since 13.1.0 (Sep 25, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-45783
    Affects 13.0.4-980038477 to 16.2.6-cc151e147 (16.2.6 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 1

  • libp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

    Affected: fixed in 16.2.6.

    Fixed in 16.2.6 (released May 13, 2026, 28 days before disclosure).

    The latest release, 16.4.9, is not affected.

    47% of @libp2p/kad-dht downloads last week were affected versions (19K).