Is CVE-2026-79914 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79914 being exploited in the wild.

How severe is CVE-2026-79914?

Medium severity, with a CVSS score of 4.3, published 10 November 2026.

Which products and versions are affected?

Nocobase 2.1.0 through 2.1.14; @nocobase/plugin-action-custom-request (npm) >= 2.1.0-alpha.8, < 2.1.15, SEMVER:introduced=2.1.0-alpha.8,fixed=2.1.15.

How is CVE-2026-79914 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79914?

Check whether you run Nocobase or @nocobase/plugin-action-custom-request (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79914: NocoBase server-side request forgery in customRequests:send

Q: Is there a fix for CVE-2026-79914?

Yes. @nocobase/plugin-action-custom-request (npm): upgrade to 2.1.15 or later. Until then: Set the SERVER_REQUEST_WHITELIST environment variable to restrict allowed request destinations, or upgrade to version 2.1.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-79914 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-79914?

Check whether you run Nocobase or @nocobase/plugin-action-custom-request (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79914 · Severity: medium · CVSS 4.3 · Published 2026-11-10

NocoBase is a no-code platform for building business applications. A low-privileged user can manipulate the customRequests:send endpoint to force the NocoBase server to send HTTP requests to attacker-controlled or internal destinations, bypassing URL restrictions. This could expose internal databases, cloud metadata endpoints, or allow the server to be used as a proxy to attack other systems.

Technologies: Nocobase. Vendors: NocoBase, npm.

Quick answers

Is CVE-2026-79914 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79914 being exploited in the wild.
How severe is CVE-2026-79914?: Medium severity, with a CVSS score of 4.3, published 10 November 2026.
Which products and versions are affected?: Nocobase 2.1.0 through 2.1.14; @nocobase/plugin-action-custom-request (npm) >= 2.1.0-alpha.8, < 2.1.15, SEMVER:introduced=2.1.0-alpha.8,fixed=2.1.15.
Is there a fix for CVE-2026-79914?: Yes. @nocobase/plugin-action-custom-request (npm): upgrade to 2.1.15 or later. Until then: Set the SERVER_REQUEST_WHITELIST environment variable to restrict allowed request destinations, or upgrade to version 2.1.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79914 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79914?: Check whether you run Nocobase or @nocobase/plugin-action-custom-request (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nocobase/plugin-action-custom-request (npm): upgrade to 2.1.15 or later
```
npm install @nocobase/plugin-action-custom-request@2.1.15
```

Set the SERVER_REQUEST_WHITELIST environment variable to restrict allowed request destinations, or upgrade to version 2.1.15 or later.

Technical details

A server-side request forgery vulnerability exists in the @nocobase/plugin-action-custom-request component. An authenticated user can override the stored request URL at runtime by injecting options.url into the request body sent to POST /api/customRequests:send, causing the server to make arbitrary outbound HTTP requests. The vulnerability is exploitable only when SERVER_REQUEST_WHITELIST environment variable is not configured.

Affected products

NocoBase NocoBase 2.1.0 through 2.1.14

Identifiers

CVE-2026-79914
GHSA-wrr5-j383-f7h2

Timeline

2026-10-14: disclosed
2026-11-10: advisory
2026: patched: Version 2.1.15

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.