Log in Start free

Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M

CVE-2026-107805Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

High 7.5

In plain English

A high-severity uncontrolled resource consumption in nginx-ui from 0xJacky. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/0xJacky/Nginx-UI1.9.10-0.20260901043436-8c9b9a1aff21GHSA-j3hg-9rp3-5hw9
Gogithub.com/0xJacky/Nginx-UI1.9.10-0.20260901043436-8c9b9a1aff21GO-2026-6734

Affected products (as reported)

VendorProductVersions
0xJacky nginx-ui >= 2.5.0, < 2.6.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References