CVE-2026-62300

CVE-2026-62300 is a medium-severity uncontrolled resource consumption vulnerability in filecoin-pin (npm), affecting versions <= 1.1.0. It is fixed in 1.1.1.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

filecoin-pin: Unbounded DAG pinning can exhaust server resources

The IPFS Pinning Service API implementation accepts a caller-controlled CID through POST /pins, queues background processing, and then recursively fetches the full DAG with helia.pins.add(cid). The route and background pinning path do not enforce a request rate limit, per-user quota, maximum DAG byte count, maximum block count, traversal timeout, or concurrent pinning limit.

An authenticated caller, or an unauthenticated caller when the server is started with ALLOW_NO_AUTH=true, can submit one or more pins whose CIDs resolve to very large DAGs. The server writes fetched blocks to CAR files under carStoragePath and can consume disk, network, CPU, and libp2p resources until the process or host becomes unavailable.

Details

POST /pins validates only that the request body contains a syntactically valid CID string, then forwards it to the pin store:

  • src/filecoin-pinning-server.ts:304-342 accepts the request, parses cid with CID.parse, and calls pinStore.pin(request.user, cidObject, parsed.options).
  • src/filecoin-pin-store.ts:153-188 stores the pin as queued and schedules _processPinInBackground with setTimeout. There is no queue, semaphore, or global cap around this scheduling.
  • src/filecoin-pin-store.ts:211-217 creates a per-pin Helia node and forwards caller-supplied origins.
  • src/filecoin-pin-store.ts:260-274 walks the full DAG with for await (const pinnedCid of helia.pins.add(cid)).
  • src/create-pinning-helia.ts:47-80 creates a libp2p/Helia node with the Bitswap block broker and no application-level resource limits.
  • src/core/car/car-blockstore-base.ts:65-107 writes every fetched block and updates stats.totalSize only after writing.
  • src/core/car/car-file-backend.ts:84-93 streams blocks to the CAR writer on disk.

The Helia node created for each pin has no bootstrap or mDNS configuration (src/create-pinning-helia.ts:57). A public CID alone may therefore not be fetchable unless the node can reach a content source. In practice, the API also accepts origins, so an attacker can supply a reachable attacker-controlled libp2p origin that serves a large DAG and cause the server to retrieve it.

PoC

curl -X POST "https://target.example/pins" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cid": "CID_OF_LARGE_DAG",
    "origins": ["/ip4/203.0.113.10/tcp/4001/p2p/ATTACKER_PEER_ID"],
    "meta": { "purpose": "resource-exhaustion-validation" }
  }'

Submitting many such requests concurrently accelerates resource pressure because each request schedules independent background processing.

Impact

Successful exploitation affects availability:

  • Disk exhaustion from unbounded CAR files in carStoragePath.
  • Network exhaustion from recursive Bitswap retrieval.
  • CPU and memory pressure from concurrent libp2p/Helia pin operations.
  • Service degradation or process failure for other users of the daemon.
  • Operational cost and manual recovery burden from large partial CAR files.

The default daemon configuration reduces exposure because the server binds to localhost and refuses to start without an access token unless ALLOW_NO_AUTH=true. The finding is most significant when the daemon is exposed beyond localhost, when the token is shared across untrusted users, or when the no-auth mode is enabled.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

CVE-2026-62300 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.1.1); upgrading removes the vulnerable code path.

Affected versions

filecoin-pin (<= 1.1.0)

Security releases

filecoin-pin → 1.1.1 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

Upgrade filecoin-pin to 1.1.1 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

  1. What is CVE-2026-62300? CVE-2026-62300 is a medium-severity uncontrolled resource consumption vulnerability in filecoin-pin (npm), affecting versions <= 1.1.0. It is fixed in 1.1.1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
  2. How severe is CVE-2026-62300? CVE-2026-62300 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which versions of filecoin-pin are affected by CVE-2026-62300? filecoin-pin (npm) versions <= 1.1.0 is affected.
  4. Is there a fix for CVE-2026-62300? Yes. CVE-2026-62300 is fixed in 1.1.1. Upgrade to this version or later.
  5. Is CVE-2026-62300 exploitable, and should I be worried? Whether CVE-2026-62300 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2026-62300 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2026-62300? Upgrade filecoin-pin to 1.1.1 or later.

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo