Description
NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | 0 <2026.08.1 | — |