CVE-2026-46551: NocoDB denial of service via disk exhaustion in attachment API

CVE-2026-46551 · Severity: medium · CVSS 6.5 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw in the attachment upload feature allows users with "Editor" permissions or higher to force the server to download extremely large files from the internet. This can fill up the server's storage space, leading to system crashes, data saving failures, and a total shutdown of the service.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-46551 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46551 being exploited in the wild.
How severe is CVE-2026-46551?
Medium severity, with a CVSS score of 6.5, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.
Is there a fix for CVE-2026-46551?
A patch was published on 2026.04.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46551 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46551?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in NocoDB's v1 and v2 attachment APIs. The 'uploadViaURL' functionality in 'attachments.service.ts' performs a HEAD request to check remote files but fails to validate the 'content-length' header against the 'NC_ATTACHMENT_FIELD_SIZE' limit. Furthermore, the subsequent download via 'storageAdapter.fileCreateByUrl()' does not implement a maximum content length for the response stream. An authenticated attacker with at least Editor-level privileges can exploit this to cause disk exhaustion, leading to a Denial of Service (DoS). This issue is resolved in version 2026.04.4.

Affected products

  • NocoDB NocoDB < 2026.04.4

Identifiers

  • CVE-2026-46551
  • GHSA-99vc-2jx2-688p

Timeline

  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD
  • 2026.04.4: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.