{"data":{"id":"c86c90a5-947f-4997-af5a-a128284c3b4b","title":"GHSA-pq7c-x8g4-rvp6: NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes","summary":"Two FastAPI routes in NiceGUI, the per-component resource route (added in v1.4.6) and the ESM module route (added in v3.0.0), accept a sub-path that can resolve to a directory. The existence check uses pathlib.Path.exists(), which returns True for directories, so the request passes the guard and raises an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn logs as a full traceback. Because the routes need no authentication, a remote attacker can inflate log volume and consume disk and log-pipeline capacity, with no confidentiality or integrity impact.","solution":"Upgrade NiceGUI. For deployments that cannot upgrade immediately: place NiceGUI behind a reverse proxy that rejects requests where the path after /_nicegui/<version>/esm/<key>/ or /_nicegui/<version>/resources/<key>/ is empty; rate-limit the /_nicegui/ prefix at the proxy; and configure log rotation aggressively for the affected service.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pq7c-x8g4-rvp6","publishedAt":"2026-05-18T20:22:07.000Z","cveId":"CVE-2026-45554","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["nicegui@<= 3.11.1 (fixed: 3.12.0)"],"affectedPackageNames":["nicegui"],"affectedPackageRefs":["pypi:nicegui"],"affectedVendors":[],"affectedVendorsRaw":["NiceGUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00343,"epssCheckedAt":"2026-11-07T12:08:48.156Z","kevDateAdded":null,"advisoryAliases":["GHSA-pq7c-x8g4-rvp6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-18T20:22:07.000Z","fixReleasedAt":"2026-05-12T14:22:02.317Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:35:49.324Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"nicegui","fixedVersion":"3.12.0","matchedVersion":"3.12.0","fixReleasedAt":"2026-05-12T14:22:02.317Z","daysToFix":-6,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:35:49.178Z"}]}}