AIKIDO-2026-974954
nicegui is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
niceguiTL;DR
NiceGUI resolves the disconnecting client in _on_disconnect from a client_id read out of the socket connect query string, which a peer can leave empty while supplying client_id only in the handshake payload. The missing query key raises a KeyError before cleanup runs, so the client stays permanently marked as connected and its instance, outbox task, and tab storage are never reclaimed by the periodic pruner. Each unauthenticated connect and disconnect cycle strands these resources, and repeated cycles exhaust server memory. The fix resolves the disconnecting client from server-side transport state instead of the client-supplied query key.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
nicegui is vulnerable to Uncontrolled Resource Consumption in versions 1.3.17 - 3.15.0.
How to fix this
Upgrade the nicegui library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant