CVE-2026-46551

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.

• CWE-770

• https://github.com/nocodb/nocodb/security/advisories/GHSA-99vc-2jx2-688p

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46546Frappe Learning Management System (LMS) is a learning system…5.4
• CVE-2026-46547NocoDB is software for building databases as spreadsheets. P…6.1
• CVE-2026-46548NocoDB is software for building databases as spreadsheets. P…4.3
• CVE-2026-46549NocoDB is software for building databases as spreadsheets. P…2
• CVE-2026-4655The Element Pack Addons for Elementor plugin for WordPress i…6.4
• CVE-2026-46550NocoDB is software for building databases as spreadsheets. P…5.4
• CVE-2026-46552NocoDB is software for building databases as spreadsheets. P…5.8
• CVE-2026-46553NocoDB is software for building databases as spreadsheets. P…2.1
• CVE-2026-46554NocoDB is software for building databases as spreadsheets. P…2.3
• CVE-2026-46555WhatsApp MCP Server is a Model Context Protocol (MCP) server…7.7
• CVE-2026-46556FlaskBB is a Forum Software written in Python using the micr…6.5
• CVE-2026-46557ImageMagick is free and open-source software used for editin…6.2