CVE-2026-45554: NiceGUI Unauthenticated Log-Volume Denial of Service Vulnerability
Summary
CVE-2026-45554: NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes. Affects nicegui versions < 3.12.0. Fixed in 3.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is an open-source Python library designed to simplify the creation of web applications with a focus on user interface components. It leverages FastAPI for backend functionality, allowing developers to build interactive applications quickly. However, NiceGUI has a vulnerability that exposes certain routes to unauthenticated access, leading to potential denial of service through excessive log generation.
Vulnerability Detail
The vulnerability arises from two FastAPI routes in NiceGUI that serve static assets. These routes accept a sub-path parameter that can resolve to a directory instead of a file. When a request resolves to a directory, it triggers an unhandled RuntimeError in Starlette's FileResponse, resulting in a 500 error response and a lengthy traceback logged by Uvicorn. This issue is particularly concerning as it allows unauthenticated attackers to repeatedly send crafted requests, leading to excessive log volume that can exhaust disk space and overwhelm log-processing systems. The vulnerability does not pose risks to confidentiality or integrity but can significantly disrupt service availability.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.12.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.12.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workarounds: 1. Place NiceGUI behind a reverse proxy that rejects requests where the path after '/_nicegui/<version>/esm/<key>/' or '/_nicegui/<version>/resources/<key>/' is empty. 2. Rate-limit requests to the '/_nicegui/' prefix at the proxy level. 3. Configure aggressive log rotation for the affected service to manage log volume effectively.
Conclusion
CVE-2026-45554 represents a significant vulnerability in NiceGUI that can lead to denial of service through unauthenticated access to specific routes. It is crucial for users of NiceGUI to upgrade to the patched version or implement workarounds to mitigate the risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for nicegui →
FAQ
CVE-2026-45554 is a vulnerability in NiceGUI that allows unauthenticated attackers to generate excessive log volume, potentially leading to denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
The primary impact is the potential for denial of service due to excessive log generation, which can exhaust disk space and overwhelm log-processing systems.
No, the vulnerability does not expose any sensitive data; it only affects log volume and service availability.
If you cannot upgrade, implement the suggested workarounds, such as using a reverse proxy to filter requests and configuring log rotation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
