Allocation of Resources Without Limits or Throttling Affecting nicegui package, versions [,3.12.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-NICEGUI-16757878
- published19 May 2026
- disclosed18 May 2026
- creditbitinerant
Introduced: 18 May 2026
NewCVE-2026-45554 (opens in a new tab)How to fix?
Upgrade nicegui to version 3.12.0 or higher.
Overview
nicegui is a Create web-based user interfaces with Python. The nice way.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the FileResponse method. An unauthenticated attacker can exhaust disk space, saturate log pipelines, or generate alert fatigue by sending crafted requests that trigger unhandled exceptions and excessive logging.
Workaround
This vulnerability can be mitigated by placing the application behind a reverse proxy that rejects requests with empty paths after the affected endpoints, rate-limiting the relevant URL prefix at the proxy, or configuring aggressive log rotation for the service.