Read the docs
TI-2026-34230 Aliases CVE-2026-46551GHSA-99vc-2jx2-688p

NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

Priority LOW 29CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Fixed nocodb (nocodb): 2026.04.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nocodbnocodbbefore 2026.04.42026.04.4Patch availableCNA
—nocodb (npm)up to 0.301.3—No fix listedGHSA-99vc-2jx2-688p
  • nocodb Vendornocodb Affected before 2026.04.4 Fixed in 2026.04.4 Patch available CNA
  • nocodb (npm) Vendor— Affected up to 0.301.3 Fixed in — No fix listed GHSA-99vc-2jx2-688p

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*——nocodb
  • cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:* Versions — — ·nocodb

Remediation

  • Fix · CNA nocodb (nocodb) Fixed in 2026.04.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46551
  2. 2026-10-03 Alias added: GHSA-99vc-2jx2-688p

References

Advisory 1

Other 2

  • TI-2023-17918 NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an… CVSS 3.1HIGH 7.5
  • TI-2023-27191 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue CVSS 3.1HIGH 7.6
  • TI-2026-19968 NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality CVSS 3.1MEDIUM 6.4
  • TI-2023-04694 Improper Input Validation in nocodb/nocodb CVSS 3.1MEDIUM 6.5
  • TI-2026-34945 NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` CVSS 3.1MEDIUM 6.0
  • TI-2025-20338 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page CVSS 3.1MEDIUM 6.1
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences