---
id: "CVE-2026-107805"
kind: "vulnerability"
aliases: ["CVE-2026-107805", "GHSA-j3hg-9rp3-5hw9", "GO-2026-6734"]
title: "Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI"
severity: "high"
cvss: 7.5
epss: 0.00468
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/0xJacky/Nginx-UI", "fixed": ["1.9.10-0.20260901043436-8c9b9a1aff21"], "affected": ">= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "nginx", "nginx-ui", "package", "self-hosted"]
not_affected_if: ["api-not-network-reachable", "version-2.6.0-or-later", "version-before-2.5.0"]
published_at: "2026-10-09T15:17:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:01+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6734", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107805", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107805", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI

Nginx UI, a web interface for managing Nginx, stages request bodies to temporary disk on its node-signature authentication path before checking the signature. An unauthenticated remote client can fill temporary storage and tie up disk I/O and request handling, causing a denial of service; it does not grant access or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/0xJacky/Nginx-UI affected >= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21 fixed 1.9.10-0.20260901043436-8c9b9a1aff21

## How to check

Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; affected range is 2.5.0 up to but not including 2.6.0 (Go pseudo-versions 1.9.10-0.20260729084040-acb59fdd81db through before 1.9.10-0.20260901043436-8c9b9a1aff21).
Confirm whether the node API is reachable from untrusted networks.

## Fix

Upgrade Nginx UI to 2.6.0 (Go module 1.9.10-0.20260901043436-8c9b9a1aff21 or later).
Until upgraded, restrict network access to the Nginx UI API to trusted hosts.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6734
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107805
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107805

## From the sources

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_