nocodb

v0.301.3npm· JavaScript

NocoDB Backend

The verdict

Maintained. Maintained, actively maintained. Catch: 8 moderate advisories — review before adopting; pulls in 163 runtime dependencies.

Catch: 8 moderate advisories — review before adopting; pulls in 163 runtime dependencies.

Live from the npm registry · derived rules, not AI

How it scores

MaintenanceHealthy

PopularityUnknown

Security8 advisories

LicenseOther

DepsHeavy

Maintenance

Last published 3 months ago.

Popularity

Download count unavailable.

Security

8 known advisories (worst: moderate).

License

Sustainable Use License

Dependencies

163 direct dependencies

Security advisories

Live from OSV.dev · cached 24h

MEDIUM
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
GHSA-2c5x-4jgf-88mj Published 2026-05-21
MEDIUM
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
GHSA-99vc-2jx2-688p Published 2026-05-21
MEDIUM
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
GHSA-9qgr-6vpg-9gh9 Published 2026-05-21
MEDIUM
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
GHSA-chqv-vrj7-qffp Published 2026-05-21
MEDIUM
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
GHSA-f74w-272x-mqcv Published 2026-05-21
LOW
NocoDB: Attachment Size Limit Bypass via Upload-by-URL
GHSA-8rwr-f68v-cvw6 Published 2026-05-21
LOW
NocoDB: Stale Auth Cache After API Token Deletion
GHSA-f76x-f9vj-92jv Published 2026-05-21
LOW
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
GHSA-m5qg-rvjq-727p Published 2026-05-21

Recent releases