CVE-2026-126267: NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging
NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated NocoDB user can trigger the denial of service remotely. No user interaction is required.
Which deployments are affected?
NocoDB versions from 0.300.0 up to, but not including, 2026.04.4 are affected.
What does an attacker need to send?
The attacker must send a request that leaves a lookup condition undefined. This causes a knex binding error in an unawaited MetaService logging call, resulting in an unhandled promise rejection that terminates the server process.