Executive brief
NocoDB is an open-source platform that turns databases into easy-to-use spreadsheets. A security flaw allowed users with upload permissions to bypass file size limits when attaching files via a URL. This could lead to unexpected storage costs or resource exhaustion if users upload excessively large files that exceed the administrator's intended restrictions.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in NocoDB's attachment service. Prior to version 2026.04.1, the 'upload-by-URL' path failed to validate the NC_ATTACHMENT_FIELD_SIZE configuration against the Content-Length header of remote files or the decoded length of data URIs. An authenticated attacker with upload permissions could exploit this to bypass per-file size limits. The fix introduces checks against HEAD response headers and data URI lengths, and implements maxContentLength constraints on the underlying axios download requests to prevent streaming beyond the limit.
Affected products
- NocoDB NocoDB < 2026.04.1
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD