NocoDB: Server-Side Request Forgery via Database Connection Host
Summary
The connection-test endpoint opened a raw TCP socket to the user-supplied database
host without resolving and range-checking the destination, so private and link-local
addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver.
Details
A new validateDbConnectionHost helper resolves hostnames through DNS, parses each
address with ipaddr.js, normalises IPv4-mapped IPv6, and rejects addresses in the
private, loopback, link-local, unique-local, reserved, unspecified, broadcast, and
carrier-grade-NAT ranges. 0.0.0.0, ::, and the literal localhost are special-cased.
The check runs before the existing SSL block in the connection-test controller and
gates the driver invocation.
Impact
Authenticated users with connection-test permission could probe internal services (Redis, the cloud metadata endpoint, internal databases) reachable from the NocoDB process. A DNS rebinding attacker could still race the resolve-vs-connect window.
Credit
This issue was reported by @helwor-01.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | nocodb | < 2026.05.1 | 2026.05.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-918- Platform
- npm
- Package
nocodb- Disclosed
- 05.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-w43h-r5m5-p832 - CC BY 4.0
Vulnerability history: nocodb
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 54
- First → latest
- 06.2022 06.2026
- Without a fix
- 13
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 6
Disclosures per year
- 2022: 5
- 2023: 2
- 2024: 3
- 2025: 1
- 2026: 43
-
NocoDB: Server-Side Request Forgery via Database Connection Host this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.