CVE-2026-24766: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24766 is a prototype pollution vulnerability in NocoDB, an open-source platform for building databases as spreadsheets, affecting all versions prior to 0.301.0. An authenticated user with org-level-creator permissions can exploit the /api/v2/meta/connection/test endpoint to pollute Object.prototype globally, causing all database write operations to fail application-wide until the server is restarted. The vulnerability was published on January 28, 2026, and patched in version 0.301.0. It carries a CVSS v3.1 base score of 4.9 (Moderate) (GitHub Advisory, NocoDB Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), stemming from the deepMerge() function in packages/nocodb/src/utils/dataUtils.ts, which does not sanitize prototype-polluting keys such as __proto__, constructor, and prototype. The testConnection endpoint in packages/nocodb/src/controllers/utils.controller.ts passes user-controlled request body input directly to deepMerge(config, body) without sanitization. When an attacker sends a payload such as {"__proto__": {"super": true}}, the super property is written to Object.prototype, affecting all plain objects in the Node.js process and breaking database write operations globally. Exploitation requires authentication with org-level-creator permissions but no further user interaction (NocoDB Advisory, GitHub Advisory).

Successful exploitation results in an application-wide denial of service (DoS) affecting all database write operations for all users of the NocoDB instance until the server process is restarted. While the prototype pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution occurs. There is no confidentiality or integrity impact; the sole consequence is high availability impact to the affected NocoDB deployment (NocoDB Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (0.000380), indicating a low probability of exploitation in the near term. Exploitation requires an authenticated account with org-level-creator permissions, which meaningfully limits the attack surface.

1. Obtain credentials: Acquire or compromise an account with org-level-creator permissions on a vulnerable NocoDB instance (version < 0.301.0).
2. Authenticate: Log in to the NocoDB application and obtain a valid session token or API key.
3. Craft malicious payload: Prepare a JSON request body containing a prototype-polluting key, e.g., {"__proto__": {"super": true}}.
4. Send request to vulnerable endpoint: Submit an authenticated HTTP POST request to /api/v2/meta/connection/test with the crafted payload as the request body.
5. Trigger prototype pollution: The deepMerge() function recursively merges the __proto__ key into Object.prototype, writing the super property globally across the Node.js process.
6. Achieve DoS: All subsequent database write operations for all users fail application-wide until the server process is restarted, effectively causing a denial of service (NocoDB Advisory).

• Network: Authenticated HTTP POST requests to /api/v2/meta/connection/test with JSON bodies containing __proto__, constructor, or prototype keys from org-level-creator accounts.
• Logs: Application error logs showing widespread database write failures across all users shortly after a specific API request; Node.js process logs indicating unexpected property presence on Object.prototype.
• Application Behavior: Sudden, application-wide failure of all database write operations affecting all users simultaneously, resolving only after server restart — particularly if preceded by a request to the connection test endpoint.

Upgrade NocoDB to version 0.301.0 or later, which patches the deepMerge() function to sanitize prototype-polluting keys (__proto__, constructor, prototype). As an interim measure, restrict org-level-creator permissions to only trusted users to reduce the attack surface. Monitor authentication and API access logs for suspicious requests to the /api/v2/meta/connection/test endpoint (NocoDB Advisory, GitHub Advisory).