Description
NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | 0.300.0 – < 2026.04.4 | 2026.04.4 |
References
- GitHub Security Advisory (GHSA-gcxw-8q43-jhjc) vendor-advisory
- VulnCheck Advisory: NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging third-party-advisory