filecoin-project CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM filecoin-project CVE published 2026-11-05

CVE-2026-62300

The filecoin-pin package has a vulnerability in its IPFS Pinning Service API implementation. An authenticated caller, or an unauthenticated caller when the server is started with ALLOW_NO_AUTH=true, can submit one or more pins whose CIDs resolve to very large DAGs. This can cause the server to consume disk, network, CPU, and libp2p resources until the process or host becomes unavailable.