Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 NocoDB, Missing File Size Enforcement, #CVE-2026-46551 (MODERATE) https://dailycve.com/nocodb-missing-file-size-enforcement-cve-2026-46551-moderate/
Post summary
The post announces CVE‑2026‑46551 for NocoDB, describing it as a moderate‑severity flaw involving missing file size enforcement, with no evidence of exploitation, patches, or PoC provided.