libp2p / libp2p/js-libp2p

PUT_VALUE handler overwrites stored records without version comparison

Open
#3,377 5 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

need/triage
Dominant language
TypeScript
Stars
2.6k
Forks
546
Avg merge
8h 18m
Merged PRs (30d)
16

Description

- **Version**: 15.1.11

- **Platform**: 6.1.0-42-amd64 Debian 6.1.159-1 (2025-12-30) x86_64 GNU/Linux

- **Subsystem**: kad-dht

#### Severity: High - Low (Depending on the knowledge of this)

#### Description
PutValueHandler.handle() validates the incoming record's signature. After that, it unconditionally overwrites whatever is stored locally. The selector is never called during PUT. This means a valid but older signed record can overwrite a newer one on any DHT node. A malicious peer can exploit this by aggressively re-publishing stale records.

Expected behavior: before overwriting, check the existing record using the selector and reject the incoming record if it's older.

Is this intentional? If so, what's the recommended mitigation for applications that store mutable versioned records?
For example, I mitigated the issue like this: I forked the kad-dht PUT_VALUE handler to check if a record already exists locally before overwriting — if the incoming record has a lower version than the stored one, the PUT is rejected.

*Why I put it as Severity High - Low*: I did not know about this. After talking with some other people who use this library, I found out they do not know either. I even asked Sonnet 4.5 and after a 45 second research, it said "_Yes, the PUT handler does use selectors_". If this is common knowledge, I apologize.

#### Steps to reproduce the error: N/A

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the kad-dht PutValueHandler.handle() entry point and trace how stored records and the selector are handled during PUT_VALUE. Verify the existing record is compared with the incoming record and that an older valid record is not accepted; add or run focused coverage for this behavior if the subsystem provides it.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
distributed-systems, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.