Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M
CVE-2026-45554NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes
Medium 5.3
In plain English
A medium-severity resource allocation without limits in nicegui from zauberzeug. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | nicegui | 3.12.0 | GHSA-pq7c-x8g4-rvp6 |
| PyPI | nicegui | 3.12.0 | PYSEC-2026-2680 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zauberzeug | nicegui | < 3.12.0 |
Weakness: CWE-248, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6 x_refsource_CONFIRM
- https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0 x_refsource_MISC