PyPI/nicegui CVE-2026-33332: medium 5.3, EPSS 0.62%
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Action: Upgrade nicegui to 3.9.0 or later.
pip install nicegui==3.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.9.0 | - |
Fixed versions
| 3.9.0 |
Sources
- osv: GHSA-w5g8-5849-vj76
- https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76
- https://nvd.nist.gov/vuln/detail/CVE-2026-33332
- https://github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b
- https://github.com/zauberzeug/nicegui
- https://github.com/zauberzeug/nicegui/releases/tag/v3.9.0
CVE-2026-33332 · published · modified · JSON