CVE-2026-21874 NiceGUI has Redis connection leak via tab storage causes service degradation
An unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs, causing service degradation in NiceGUI applications using Redis-backed storage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21874?
CVE-2026-21874 is a medium-severity denial of service vulnerability in zauberzeug nicegui, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.
Weakness: CWE-772
Which versions are affected by CVE-2026-21874?
3 open source packages ship an affected version, including nicegui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nicegui PyPI | From 2.10.0 | 3.5.0 |
nicegui PyPI | From 2.10.0 | 3.5.0 |
nicegui PyPI | From 2.10.0 | 3.5.0 |
Products include Zauberzeug Nicegui.
How do I fix CVE-2026-21874?
Upgrade nicegui to 3.5.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-21874 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21874 exists.
Other vulnerabilities in zauberzeug nicegui
- CVE-2026-25732 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
- CVE-2025-66645 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading
- CVE-2026-21873 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`
- CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
- CVE-2026-27156 NiceGUI has XSS via Code Injection
Sources
Also known as GHSA-mp55-g7pj-rvm2, PYSEC-2026-1703.