Nitrite: Insecure deserialization in legacy database migration (CVE-2026-64678)
The Nitrite (NO2) NoSQL database contains a vulnerability where legacy database file migration performs insecure Java deserialization, potentially allowing remote code execution if a suitable gadget class is present on the classpath.
CVE search metadata
CVE search record: CVE-2026-64678. Severity: critical. CVSS: 9.8. KEV: no. Product: Nitrite (< 4.4.1). Brief: Nitrite: Insecure deserialization in legacy database migration (CVE-2026-64678). Brief link: https://feed.craftedsignal.io/briefs/2026-11-nitrite-deserialization-cve-2026-64678/
Triage facts
Revision 1- Applicability
- Nitrite (< 4.4.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Nitrite (NO2) database is an open source NoSQL embedded document store. In versions prior to 4.4.1, when the MVStoreUtils.openOrCreate() method detects a legacy v1-format store or encounters a compatibility error, it triggers an automatic migration path. This path deserializes stored values by passing raw bytes to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. This subclass does not implement an allowlist, blocklist, or ObjectInputFilter. Consequently, any Serializable class reachable on the application's classpath can be instantiated, leading to the unconditional invocation of readObject(), readExternal(), or readResolve() callbacks. The presence of a gadget class on the classpath is a precondition for remote code execution. This issue has been patched in version 4.4.1.