{"id":"CVE-2026-62300","aliases":["GHSA-m5ph-mmg5-6w5h"],"title":"filecoin-pin: Unbounded DAG pinning can exhaust server resources","summary":"filecoin-pin: Unbounded DAG pinning can exhaust server resources","severity":"medium","cvss":6.5,"cwe":["CWE-400"],"vendor":"filecoin-pin","product":"filecoin-pin","ecosystem":"npm","affected":["filecoin-pin <= 1.1.0"],"patched":["filecoin-pin 1.1.1"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T18:07:31Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m5ph-mmg5-6w5h","references":[{"url":"https://github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-m5ph-mmg5-6w5h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62300"},{"url":"https://github.com/filecoin-project/filecoin-pin/commit/8db22b47899deb78dadf415fc477cae4bd6e82c2"},{"url":"https://github.com/filecoin-project/filecoin-pin/commit/afa019307db23a703737675e94316edcc6572050"},{"url":"https://github.com/filecoin-project/filecoin-pin/releases/tag/v1.1.1"},{"url":"https://github.com/advisories/GHSA-m5ph-mmg5-6w5h"}],"tags":["ghsa","npm"],"epss":0.00249,"epssPercentile":0.16317,"ingestedAt":"2026-11-05T18:28:50.454Z","slug":"CVE-2026-62300","body":"## Overview\n\n## Summary\n\nThe IPFS Pinning Service API implementation accepts a caller-controlled CID through `POST /pins`, queues background processing, and then recursively fetches the full DAG with `helia.pins.add(cid)`. The route and background pinning path do not enforce a request rate limit, per-user quota, maximum DAG byte count, maximum block count, traversal timeout, or concurrent pinning limit.\n\nAn authenticated caller, or an unauthenticated caller when the server is started with `ALLOW_NO_AUTH=true`, can submit one or more pins whose CIDs resolve to very large DAGs. The server writes fetched blocks to CAR files under `carStoragePath` and can consume disk, network, CPU, and libp2p resources until the process or host becomes unavailable.\n\n## Details\n\n`POST /pins` validates only that the request body contains a syntactically valid CID string, then forwards it to the pin store:\n\n- `src/filecoin-pinning-server.ts:304-342` accepts the request, parses `cid` with `CID.parse`, and calls `pinStore.pin(request.user, cidObject, parsed.options)`.\n- `src/filecoin-pin-store.ts:153-188` stores the pin as `queued` and schedules `_processPinInBackground` with `setTimeout`. There is no queue, semaphore, or global cap around this scheduling.\n- `src/filecoin-pin-store.ts:211-217` creates a per-pin Helia node and forwards caller-supplied `origins`.\n- `src/filecoin-pin-store.ts:260-274` walks the full DAG with `for await (const pinnedCid of helia.pins.add(cid))`.\n- `src/create-pinning-helia.ts:47-80` creates a libp2p/Helia node with the Bitswap block broker and no application-level resource limits.\n- `src/core/car/car-blockstore-base.ts:65-107` writes every fetched block and updates `stats.totalSize` only after writing.\n- `src/core/car/car-file-backend.ts:84-93` streams blocks to the CAR writer on disk.\n\nThe Helia node created for each pin has no bootstrap or mDNS configuration (`src/create-pinning-helia.ts:57`). A public CID alone may therefore not be fetchable unless the node can reach a content source. In practice, the API also accepts `origins`, so an attacker can supply a reachable attacker-controlled libp2p origin that serves a large DAG and cause the server to retrieve it.\n\n## Impact\n\nSuccessful exploitation affects availability:\n\n- Disk exhaustion from unbounded CAR files in `carStoragePath`.\n- Network exhaustion from recursive Bitswap retrieval.\n- CPU and memory pressure from concurrent libp2p/Helia pin operations.\n- Service degradation or process failure for other users of the daemon.\n- Operational cost and manual recovery burden from large partial CAR files.\n\nThe default daemon configuration reduces exposure because the server binds to `localhost` and refuses to start without an access token unless `ALLOW_NO_AUTH=true`. The finding is most significant when the daemon is exposed beyond localhost, when the token is shared across untrusted users, or when the no-auth mode is enabled.\n\n## PoC\n\n```bash\ncurl -X POST \"https://target.example/pins\" \\\n  -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"cid\": \"CID_OF_LARGE_DAG\",\n    \"origins\": [\"/ip4/203.0.113.10/tcp/4001/p2p/ATTACKER_PEER_ID\"],\n    \"meta\": { \"purpose\": \"resource-exhaustion-validation\" }\n  }'\n```\n\nSubmitting many such requests concurrently accelerates resource pressure because each request schedules independent background processing.\n\n## Affected packages\n\n- `filecoin-pin <= 1.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `filecoin-pin 1.1.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}