CVE-2026-46551: NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

May 21, 2026 (updated July 20, 2026)

The uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service.

References

github.com/advisories/GHSA-99vc-2jx2-688p
github.com/nocodb/nocodb/security/advisories/GHSA-99vc-2jx2-688p
nvd.nist.gov/vuln/detail/CVE-2026-46551

Code Behaviors & Features

Detect and mitigate CVE-2026-46551 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →