{"id":"CVE-2026-62300","kind":"vulnerability","aliases":["CVE-2026-62300"],"related":[],"title":"Filecoin Pin: unbounded pin requests let callers exhaust disk, CPU and memory","description":"Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a caller-supplied CID with `CID.parse` and passes it to `pinStore.pin`, but does not enforce request rate limits or per-user quotas. In `src/filecoin-pin-store.ts`, each pin independently schedules `_processPinInBackground` with `setTimeout` without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using `helia.pins.add(cid)`. The per-pin Helia/Bitswap node in `src/create-pinning-helia.ts` has no application-level byte, block or traversal-time limits. Blocks are written under `carStoragePath` by `src/core/car/car-blockstore-base.ts` and `src/core/car/car-file-backend.ts`, with `stats.totalSize` updated only after writing. An authenticated caller, or an anonymous caller when `ALLOW_NO_AUTH=true`, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied `origins` can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.","summary":"Filecoin Pin's pinning service has no rate limits, quotas or size caps on pin requests, so each request starts an unbounded background DAG traversal. A caller who can reach the API can exhaust disk, network, CPU and memory, degrading or crashing the host.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["filecoin","filecoin-pin","ipfs","package","self-hosted"],"not_affected_if":["default-localhost-binding","library-only-use","token-required"],"how_to_check":"- Check the installed Filecoin Pin version with `npm ls filecoin-pin` or the package.json of the deployment\n- Check whether `ALLOW_NO_AUTH` is set to `true` in the daemon environment\n- Check whether the pinning server listens on a non-localhost interface","fix":"- Filecoin Pin up to and including `1.1.0` is affected; the sources say `1.1.1` documents operational mitigations but does not implement the missing resource controls, so no fixed version is stated","status":"open","published_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:52+00:00","updated_at":"2026-10-30T21:26:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T21:26:52Z","model":"claude-haiku-5-5","output":{"fix":"- Filecoin Pin up to and including `1.1.0` is affected; the sources say `1.1.1` documents operational mitigations but does not implement the missing resource controls, so no fixed version is stated","reach":"network","title":"Filecoin Pin: unbounded pin requests let callers exhaust disk, CPU and memory","impact":"medium","summary":"Filecoin Pin's pinning service has no rate limits, quotas or size caps on pin requests, so each request starts an unbounded background DAG traversal. A caller who can reach the API can exhaust disk, network, CPU and memory, degrading or crashing the host.","audience":"developers","category":"package","nicknames":[],"who_cares":["filecoin-pin","ipfs","filecoin","self-hosted"],"confidence":0.7,"fix_status":"none","needs_auth":"yes","worst_case":"Host or process crashes from resource exhaustion; partial CAR files left behind","analyst_note":"Confirm whether any fixed version exists beyond 1.1.1 and whether ALLOW_NO_AUTH is a common default in published deployment guides.","how_to_check":"- Check the installed Filecoin Pin version with `npm ls filecoin-pin` or the package.json of the deployment\n- Check whether `ALLOW_NO_AUTH` is set to `true` in the daemon environment\n- Check whether the pinning server listens on a non-localhost interface","plain_action":"","needs_analyst":true,"not_affected_if":["default-localhost-binding","token-required","library-only-use"],"who_is_affected":"Teams running Filecoin Pin in daemon mode as an IPFS pinning service, especially if the API is reachable beyond localhost or runs with ALLOW_NO_AUTH=true. The default localhost binding and token requirement reduce exposure. Deployments that only use the library or the CLI without the daemon are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000805,"input_tokens":4596,"output_tokens":691,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62300':15A,18A '/pins':98C '1.1.0':96C '1.1.1':269C 'acceler':265C 'allow':194C 'alon':243C 'anonym':191C 'api':59B,79C 'applic':162C 'application-level':161C 'attack':259C 'attacker-control':258C 'auth':196C 'authent':187C 'background':50B 'bind':227C 'block':165C,171C 'bootstrap':237C 'byte':164C 'caller':7A,54B,104C,188C,192C,250C 'caller-suppli':103C,249C 'cap':40B,141C 'car':220C 'carstoragepath':175C 'caus':211C 'check':101C 'cid':106C,150C,242C 'cid.parse':108C 'concurr':140C,263C 'configur':240C 'control':260C,280C 'cpu':10A,64B,206C 'crash':69B 'cve':13A,16A 'daemon':89C 'dag':51B,147C,201C 'default':225C 'degrad':67B,213C 'deploy':90C 'disk':9A,62B,204C 'document':270C 'enforc':117C 'exhaust':8A,61B,203C 'exposur':232C 'failur':216C 'fetchabl':247C 'file':221C 'filecoin':1A,19B,21B,28B,72C,84C 'filecoin-pin':20B 'full':146C 'helia.pins.add':149C 'helia/bitswap':155C 'host':27B,71B 'host/process':215C 'implement':80C,276C 'includ':94C 'independ':130C 'ipf':23B,76C 'larg':200C 'leav':218C 'let':6A 'level':163C 'libp2p':209C,261C 'limit':36B,120C,170C 'localhost':226C 'may':244C 'mdns':239C 'memori':12A,66B,207C 'miss':278C 'mitig':272C 'network':63B,205C 'node':156C,234C 'oper':271C 'origin':252C 'packag':24B 'partial':219C 'pass':110C 'pdp':86C 'per':123C,153C 'per-pin':152C 'per-us':122C 'pin':2A,4A,22B,29B,31B,42B,73C,77C,82C,129C,154C 'pinstore.pin':113C 'point':254C 'post':97C 'pressur':267C 'processpininbackground':132C 'queue':137C 'quota':37B,125C 'rate':35B,119C 'reach':57B 'reachabl':257C 'recoveri':223C 'recurs':143C 'reduc':231C 'request':5A,43B,46B,118C,264C 'requir':222C,230C 'resourc':210C,266C,279C 'schedul':131C 'self':26B 'self-host':25B 'semaphor':138C 'servic':32B,78C,87C,212C 'settimeout':134C 'size':39B 'sourc':262C 'src/core/car/car-blockstore-base.ts':177C 'src/core/car/car-file-backend.ts':179C 'src/create-pinning-helia.ts':158C 'src/filecoin-pin-store.ts':127C 'src/filecoin-pinning-server.ts':100C 'start':47B 'stats.totalsize':181C 'submit':199C 'suppli':105C,251C 'time':169C 'token':229C 'travers':52B,144C,168C 'traversal-tim':167C 'true':197C 'unbound':3A,49B 'updat':182C 'use':148C 'user':124C 'version':95C,268C 'without':135C 'write':185C 'written':173C","nicknames":[],"mitigations":[],"who_affected":"Teams running Filecoin Pin in daemon mode as an IPFS pinning service, especially if the API is reachable beyond localhost or runs with ALLOW_NO_AUTH=true. The default localhost binding and token requirement reduce exposure. Deployments that only use the library or the CLI without the daemon are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62300","severity":null,"published_at":"2026-10-30T21:17:13+00:00","modified_at":"2026-10-30T21:17:13+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}