CVE-2026-62300

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce request rate limits or per-user quotas. In src/filecoin-pin-store.ts, each pin independently schedules _processPinInBackground with setTimeout without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using helia.pins.add(cid). The per-pin Helia/Bitswap node in src/create-pinning-helia.ts has no application-level byte, block or traversal-time limits. Blocks are written under carStoragePath by src/core/car/car-blockstore-base.ts and src/core/car/car-file-backend.ts, with stats.totalSize updated only after writing. An authenticated caller, or an anonymous caller when ALLOW_NO_AUTH=true, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied origins can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.