External risk intelligence

Nitrite Database Deserialization Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64678

Nitrite is an embedded database, meaning it is a library integrated directly into an application rather than a standalone network service or appliance. Its operation is local to the application's process and runtime environment. While it handles file-based data, it does not typically expose a network port or interface to the public internet, making the vulnerable surface primarily internal to the application.

Deserialization

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Nitrite database affecting certain older versions when opening specific database files. This could allow an attacker to execute arbitrary code if a vulnerable application uses this database and a malicious file is encountered. The main concern is confirming if our systems utilize this technology and are exposed.

Database vulnerability allows code execution.
Matters if we use the affected database.
Confirm usage and exposure for relevant systems.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by sending a specially crafted database file to an application that uses the Nitrite database. When Nitrite attempts to open this file, it triggers an automatic migration process that deserializes the data without proper validation. This deserialization process can be manipulated to execute arbitrary code if a vulnerable gadget class is present in the application's environment.

Requires opening a malicious database file.
Deserialization of untrusted data.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When Nitrite opens a database file, it may deserialize stored values using a method that passes raw bytes directly to Java's `ObjectInputStream`. If a vulnerable gadget class is present on the application's classpath, this could lead to the instantiation of arbitrary classes and potentially remote code execution, when supported by the advisory.

Embedded database data.
Unsafe deserialization of legacy data.
Arbitrary class instantiation or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Nitrite database impacts applications that use versions prior to 4.4.1 and open a database file. Application owners are responsible for identifying instances of the affected database library within their codebases. The first practical step is to confirm if the application is exposed externally, determine its business criticality, and then plan remediation based on the identified risk.

Application owners should own the issue.
Verify reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Nitrite database?

Nitrite, or NO2, is an open-source, embedded NoSQL document store. Unlike standalone database servers that listen for network connections, it acts as a library integrated directly into an application's own process. Developers use it to manage structured data locally within the application's runtime environment, meaning the database lives alongside the software as a file rather than operating as a separate, reachable network service.

What does CVE-2026-64678 mean by deserialization vulnerability?

The vulnerability is categorized as CWE-502, which concerns Deserialization of Untrusted Data. In Nitrite, the database automatically processes older file formats by converting them to a newer structure. During this migration, it unsafely handles data objects. Because the software fails to verify or restrict which classes are being processed, it can be tricked into running unauthorized code if that code is already available within the application's environment.

How is this vulnerability triggered?

An attack requires an application to attempt to open a specially crafted or malicious database file. The flaw resides specifically within the automatic migration logic used for legacy files. If the application never processes untrusted, external database files, the automatic migration path is not triggered, and this specific deserialization mechanism remains inactive.

Is this vulnerability likely to be exposed to the internet?

According to Halo Surface Signal, this is very unlikely. Because Nitrite is an embedded library, it does not typically expose its own network port. The vulnerability is internal to the application's process. Therefore, an attacker would generally need another way to influence the application to open a malicious file rather than attacking the database directly over the internet.

What steps should I take if I use Nitrite?

First, audit your software projects to identify if they include Nitrite versions earlier than 4.4.1. If you find affected versions, prioritize upgrading to 4.4.1 or later to implement the necessary security controls. Additionally, review your application's data handling practices to ensure that any database files being opened originate from trusted sources, as this limits the risk while you plan and deploy your update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.