CVE-2026-33332: NiceGUI Media Routes Vulnerability Leading to Memory Exhaustion
Summary
CVE-2026-33332: NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion. Affects nicegui versions < 3.9.0. Fixed in 3.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python framework designed for building interactive web applications with ease. It allows developers to create user interfaces quickly and efficiently, particularly for applications that require media content delivery. However, a vulnerability exists in its media handling routes, specifically in the functions app.add_media_file() and app.add_media_files(). This vulnerability can lead to significant memory consumption when serving large media files, especially under concurrent access scenarios.
Vulnerability Detail
The vulnerability arises from the unvalidated chunk size parameter in NiceGUI's media routes. When users request media files, they can manipulate a query parameter that affects how files are streamed. This parameter is passed directly to the range-response implementation without proper validation, allowing attackers to bypass chunked streaming. Consequently, the server may attempt to load entire media files into memory instead of streaming them in manageable chunks. This can lead to excessive memory usage, performance degradation, and potential denial of service, particularly when multiple large files are accessed simultaneously.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to media endpoints or implement a reverse proxy that strips unexpected query parameters from incoming requests. This can help mitigate the risk of exploitation until a proper update is applied.
Conclusion
In summary, CVE-2026-33332 represents a significant vulnerability in NiceGUI that can lead to memory exhaustion through unvalidated media streaming parameters. It is crucial for developers using NiceGUI to upgrade to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for nicegui →
FAQ
The vulnerability allows attackers to manipulate media streaming parameters, leading to potential memory exhaustion on the server.
Any NiceGUI application that serves media content using app.add_media_file() or app.add_media_files() is at risk, especially those handling large files.
The consequences include excessive memory consumption, degraded application performance, and possible denial of service due to out-of-memory conditions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
