NOCODB · CVE-2026-126267 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB versions from 0.300.0 before 2026.04.4 have an unhandled promise rejection in metadata logging. An authenticated user can send a request with an undefined lookup condition and terminate the server process.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host NocoDB from 0.300.0 up to but not including 2026.04.4 and let users with accounts reach its API. Exposure needs a logged-in user; instances where only trusted staff have accounts carry less risk. Managed or upgraded instances at 2026.04.4 or later are not affected.
Not affected if fixed-version, managed-hosting
Who cares docker, nocodb, self-hosted
0.300.0 to before 2026.04.4)2026.04.4 or laterNocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.