{"id":"CVE-2026-107805","kind":"vulnerability","aliases":["CVE-2026-107805","GHSA-j3hg-9rp3-5hw9","GO-2026-6734"],"related":[],"title":"Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.","summary":"Nginx UI, a web interface for managing Nginx, stages request bodies to temporary disk on its node-signature authentication path before checking the signature. An unauthenticated remote client can fill temporary storage and tie up disk I/O and request handling, causing a denial of service; it does not grant access or data exposure.","severity":"high","cvss":7.5,"epss":0.00468,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260901043436-8c9b9a1aff21"],"affected":">= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["api-not-network-reachable","version-2.6.0-or-later","version-before-2.5.0"],"how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; affected range is 2.5.0 up to but not including 2.6.0 (Go pseudo-versions 1.9.10-0.20260729084040-acb59fdd81db through before 1.9.10-0.20260901043436-8c9b9a1aff21).\nConfirm whether the node API is reachable from untrusted networks.","fix":"Upgrade Nginx UI to 2.6.0 (Go module 1.9.10-0.20260901043436-8c9b9a1aff21 or later).\nUntil upgraded, restrict network access to the Nginx UI API to trusted hosts.","status":"open","published_at":"2026-10-09T15:17:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:01+00:00","updated_at":"2026-10-23T19:56:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:56:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Nginx UI to 2.6.0 (Go module 1.9.10-0.20260901043436-8c9b9a1aff21 or later).\nUntil upgraded, restrict network access to the Nginx UI API to trusted hosts.","summary":"Nginx UI, a web interface for managing Nginx, stages request bodies to temporary disk on its node-signature authentication path before checking the signature. An unauthenticated remote client can fill temporary storage and tie up disk I/O and request handling, causing a denial of service; it does not grant access or data exposure.","category":"package","who_cares":["go","nginx-ui","self-hosted","nginx"],"confidence":0.8,"analyst_note":"Sources do not say what temporary-storage path or size limits are used, or whether the node API is exposed by default; check the GHSA advisory at https://github.com/0xJacky/Nginx-UI/security/advisories for default config and mitigations.","how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; affected range is 2.5.0 up to but not including 2.6.0 (Go pseudo-versions 1.9.10-0.20260729084040-acb59fdd81db through before 1.9.10-0.20260901043436-8c9b9a1aff21).\nConfirm whether the node API is reachable from untrusted networks.\nunknown","needs_analyst":true,"not_affected_if":["version-before-2.5.0","version-2.6.0-or-later","api-not-network-reachable"],"severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2324,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107805':19A,30A '-2026':18A,26A,29A '-6734':27A '/0xjacky/nginx-ui':16A,33A '2.5.0':110C '2.6.0':112C,193C '5hw9':24A '9rp3':23A 'access':93B 'affect':174C 'api':149C 'attack':126C 'attacker-control':125C 'authent':62B,117C,180C 'avail':175C 'bodi':7A,53B,129C,136C 'bypass':179C 'capac':160C 'caus':84B 'check':65B 'client':71B,144C 'confidenti':183C 'consum':157C 'control':127C 'cryptograph':139C 'cve':17A,28A 'data':95B 'denial':86B 'digest':137C 'disk':56B,79B,161C 'exhaust':10A 'exposur':96B 'file':121C 'filesystem':159C 'fill':73B 'fix':190C 'ghsa':21A 'ghsa-j3hg-9rp3-5hw9':20A 'github.com':15A,32A 'github.com/0xjacky/nginx-ui':14A,31A 'go':25A,34B 'grant':92B 'handl':83B 'host':42B 'i/o':80B 'impact':186C 'input':162C 'integr':185C 'interfac':47B,103C 'issu':173C,188C 'j3hg':22A 'manag':49B 'metadata':155C 'nginx':1A,35B,37B,43B,50B,97C,106C 'nginx-ui':36B 'node':60B,115C 'node-signatur':59B,114C 'output':164C 'packag':39B 'path':63B,118C 'perform':119C 'process':168C 'provid':151C,182C 'reach':147C 'reject':171C 'remot':70B,143C 'request':6A,52B,82B,128C,167C 'request-process':166C 'resourc':169C 'self':41B 'self-host':40B 'server':108C 'servic':88B 'sign':5A 'signatur':61B,67B,116C,140C,154C 'signed-request':4A 'stage':8A,51B,122C 'storag':12A,75B 'synchron':131C 'syntact':152C 'temporari':11A,55B,74B,120C,158C 'tie':77B 'ui':2A,38B,44B,98C 'unauthent':3A,69B,142C 'user':102C 'valid':134C,153C 'version':192C 'web':46B,101C,107C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T15:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6734","url":"https://pkg.go.dev/vuln/GO-2026-6734","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107805","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107805","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107805","severity":null,"published_at":"2026-10-09T15:17:09+00:00","modified_at":"2026-10-20T20:50:20+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}