Live › vulnerability › CVE-2026-107805
Go to dashboardNginx UI, a web interface for managing Nginx, stages request bodies to temporary disk on its node-signature authentication path before checking the signature. An unauthenticated remote client can fill temporary storage and tie up disk I/O and request handling, causing a denial of service; it does not grant access or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | >= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21 | 1.9.10-0.20260901043436-8c9b9a1aff21 |
2.5.0 up to but not including 2.6.0 (Go pseudo-versions 1.9.10-0.20260729084040-acb59fdd81db through before 1.9.10-0.20260901043436-8c9b9a1aff21)2.6.0 (Go module 1.9.10-0.20260901043436-8c9b9a1aff21 or later)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107805")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.