Executive brief
NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw in the attachment upload feature allows users with "Editor" permissions or higher to force the server to download extremely large files from the internet. This can fill up the server's storage space, leading to system crashes, data saving failures, and a total shutdown of the service.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in NocoDB's v1 and v2 attachment APIs. The 'uploadViaURL' functionality in 'attachments.service.ts' performs a HEAD request to check remote files but fails to validate the 'content-length' header against the 'NC_ATTACHMENT_FIELD_SIZE' limit. Furthermore, the subsequent download via 'storageAdapter.fileCreateByUrl()' does not implement a maximum content length for the response stream. An authenticated attacker with at least Editor-level privileges can exploit this to cause disk exhaustion, leading to a Denial of Service (DoS). This issue is resolved in version 2026.04.4.
Affected products
- NocoDB NocoDB < 2026.04.4
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD
- 2026.04.4: patched