CVE-2026-107805
highpriority · track · 0EPSS 0.005 · 40 %ileDEUSEPSS · scored 2026-10-27
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- Go github.com/0xJacky/Nginx-UI1.9.10-0.20260729084040-acb59fdd81db → 1.9.10-0.20260901043436-8c9b9a1aff21osvUSpkg:golang/github.com/0xJacky/Nginx-UI
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3668nginx-ui: Mehrere SchwachstellenDeutsch2026-09-29csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um Administratorrechte zu erlangen, um Sicherheitsmechanismen zu umgehen, um Informationen offenzulegen oder zu manipulieren, sowie um einen Denial of Service herbeizuführen.
- GHSA-j3hg-9rp3-5hw9Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage2026-10-09ghsa · osvUS
## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API can provide syntactically valid signature metadata and cause storage and I/O consumption before the request is rejected. ## Impact Concurrent malicious requests can consume temporary filesystem capacity, disk I/O, and request-processing resources, potentially disrupting Nginx UI and other services that share the filesystem. The issue affects availability only; it does not bypass authentication and does not provide confidentiality or integrity impact. Deployment-specific reverse-proxy body limits, filesystem quotas, and concurrency limits may reduce practical impact. ## Remediation Upgrade to Nginx UI 2.6.0 or later. The fix authenticates signed request metadata before staging the body and enforces an application-level streaming size limit with cleanup for rejected requests. Fix commit: https://github.com/0xJacky/nginx-ui/commit/8c9b9a1aff218ee6c980d047b750e49da3c46796
- GO-2026-6734Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI2026-10-19vendor · osvUS
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI
also known as (2)
Other names and identifiers for this entity.
- GHSA-j3hg-9rp3-5hw9osv
- GO-2026-6734osv
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan