Live › vulnerability › CVE-2026-62300
Filecoin Pin's pinning service has no rate limits, quotas or size caps on pin requests, so each request starts an unbounded background DAG traversal. A caller who can reach the API can exhaust disk, network, CPU and memory, degrading or crashing the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Teams running Filecoin Pin in daemon mode as an IPFS pinning service, especially if the API is reachable beyond localhost or runs with ALLOW_NO_AUTH=true. The default localhost binding and token requirement reduce exposure. Deployments that only use the library or the CLI without the daemon are not described as affected.
No product ranges from the sources yet.
npm ls filecoin-pin or the package.json of the deploymentALLOW_NO_AUTH is set to true in the daemon environment1.1.0 is affected; the sources say 1.1.1 documents operational mitigations but does not implement the missing resource controls, so no fixed version is statedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce request rate limits or per-user quotas. In src/filecoin-pin-store.ts, each pin independently schedules _processPinInBackground with setTimeout without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using helia.pins.add(cid). The per-pin Helia/Bitswap node in src/create-pinning-helia.ts has no application-level byte, block or traversal-time limits. Blocks are written under carStoragePath by src/core/car/car-blockstore-base.ts and src/core/car/car-file-backend.ts, with stats.totalSize updated only after writing. An authenticated caller, or an anonymous caller when ALLOW_NO_AUTH=true, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied origins can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.
This page as .md · .json · in your agent: get_signal("CVE-2026-62300")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.