Recommended action

Update nocodb to 2026.04.1 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

NocoDB: User Enumeration via Sign-In Timing affects nocodb (npm). Severity is medium. ### Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. ### Details The unknown-user branch in `auth.service.ts` now performs a `bcrypt.compare` against a fixed dummy hash so the response time of failed sign-ins is approximately independent of whether the address exists. Rate limiting on the sign-in endpoint is implemented in the Enterprise build only and is not affected by this advisory. ### Impact A network-positioned attacker could enumerate registered email addresses by timing sign-in responses. Exploitation requires only the ability to send unauthenticated sign-in requests. ### Credit This issue was reported by [@AndyAnh174](https://github.com/AndyAnh174).

AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update nocodb to 2026.04.1 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

NocoDB: User Enumeration via Sign-In Timing affects nocodb (npm). Severity is medium. ### Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. ### Details The unknown-user branch in `auth.service.ts` now performs a `bcrypt.compare` against a fixed dummy hash so the response time of failed sign-ins is approximately independent of whether the address exists. Rate limiting on the sign-in endpoint is implemented in the Enterprise build only and is not affected by this advisory. ### Impact A network-positioned attacker could enumerate registered email addresses by timing sign-in responses. Exploitation requires only the ability to send unauthenticated sign-in requests. ### Credit This issue was reported by [@AndyAnh174](https://github.com/AndyAnh174).

AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software