# CVE-2026-45554: NiceGUI denial of service via log exhaustion in static asset routes

Source: https://junglewise.ai/threats/cve-2026-45554-nicegui-denial-of-service-via-log-exhaustion-in-static-asset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-45554 · Severity: medium · CVSS 5.3 · Published 2026-06-02

NiceGUI is a Python framework used for building web-based user interfaces. A vulnerability in how the framework handles requests for certain internal files allows unauthenticated remote attackers to trigger server errors repeatedly. This can lead to a denial-of-service condition by rapidly filling up server storage with error logs or overwhelming log-monitoring systems, potentially masking other security events or crashing the server due to lack of disk space.

Technologies: [nicegui (PyPI)](https://junglewise.ai/threats/technologies/nicegui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45554 being exploited in the wild.

**How severe is CVE-2026-45554?** Medium severity, with a CVSS score of 5.3, published 2 June 2026.

**Which products and versions are affected?** nicegui (PyPI) <= 3.11.1, ECOSYSTEM:introduced=0,fixed=3.12.0.

**Is there a fix for CVE-2026-45554?** Yes. nicegui (PyPI): upgrade to 3.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45554 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45554?** Check whether you run nicegui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nicegui (PyPI): upgrade to 3.12.0 or later

  ```sh
  pip install "nicegui>=3.12.0"
  ```


## Technical details

A denial-of-service vulnerability exists in NiceGUI's dynamic resource and ESM module routes. These routes accept a sub-path parameter and use `pathlib.Path.exists()` to validate the request; however, this check returns true for directories. When a directory path is passed to Starlette's `FileResponse`, it raises an unhandled `RuntimeError`. Because Uvicorn logs the full traceback for unhandled exceptions, an unauthenticated remote attacker can send crafted requests to amplify log volume. This can result in disk space exhaustion or the saturation of log-processing pipelines. The issue is fixed in version 3.12.0 by ensuring requested paths resolve to files rather than directories.

## Affected products

- zauberzeug NiceGUI <= 3.11.1

## Identifiers

- CVE-2026-45554
- GHSA-pq7c-x8g4-rvp6
- PYSEC-2026-2680

## Timeline

- 2026-05-12: patched: Version 3.12.0 released
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE published to NVD

## References

- [https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0](https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0)
- [https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6](https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6)

## Related threats

- [PYSEC-2026-1703 - NiceGUI has Redis connection leak via tab storage causes service degradation](https://junglewise.ai/threats/cve-2026-21874-nicegui-has-redis-connection-leak-via-tab-storage-causes-service)
- [PYSEC-2026-1702 - NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS](https://junglewise.ai/threats/cve-2026-21873-nicegui-apps-which-use-ui-sub-pages-vulnerable-to-zero-click-xss)
- [PYSEC-2026-1701 - NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links](https://junglewise.ai/threats/cve-2026-21872-nicegui-apps-are-vulnerable-to-xss-which-uses-ui-sub-pages-and)
- [PYSEC-2026-1698 - NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()](https://junglewise.ai/threats/cve-2026-21871-nicegui-is-vulnerable-to-xss-via-unescaped-url-in-ui-navigate)
- [PYSEC-2026-1697 - NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection](https://junglewise.ai/threats/cve-2025-66469-nicegui-reflected-xss-in-ui-add-css-ui-add-scss-and-ui-add-sass)