PT-2026-42608 · Npm · Nocodb

Published 2026-05-21 · Updated 2026-05-21

OSV

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Summary

The upload-by-URL path did not enforce NC ATTACHMENT FIELD SIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured per-file size limit.

Details

The attachments service now checks NC ATTACHMENT FIELD SIZE against both the HEAD response's content-length and the decoded length of a data: URI body before fetching. The local storage plugin additionally sets maxContentLength on the axios download so a malicious server cannot stream past the limit.

Impact

Authenticated users with upload permission could attach files larger than the operator-configured limit, defeating storage and bandwidth caps.

Credit

This issue was reported by @bugbunny-research.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-8RWR-F68V-CVW6

Affected Products

Nocodb

References · 3

• https://osv.dev/vulnerability/GHSA-8rwr-f68v-cvw6 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/security/advisories/GHSA-8rwr-f68v-cvw6 · Note