The @evomap/evolver proxy daemon has an unbounded HTTP request body parser on the POST /asset/submit route that accepts and persists arbitrarily large JSON payloads without size validation. An unauthenticated local attacker can exploit this to repeatedly send large requests, causing the messages.jsonl file to grow without limit and exhaust disk space. On daemon restart, the large file is synchronously read into memory, causing an out-of-memory crash that makes the denial-of-service persistent. The service listens only on localhost and has no per-request authentication, allowing any local process or container sharing the host network namespace to exploit this.