NGINX-HTTP-FLV-MODULE · CVE-2026-65982 · Runtime
NO FIX YET · SEE WHAT TO DO
nginx-http-flv-module, a media streaming module for nginx, dereferences a NULL pointer when an HTTP/1.0 request arrives without a Host header. The crash can take down the nginx worker process, and the advisory's CVSS score is 8.7.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers that run nginx with the nginx-http-flv-module for live FLV or RTMP-style streaming are exposed, because an unauthenticated HTTP/1.0 request with no Host header reaches the vulnerable code. Nginx setups without this module are not affected.
Not affected if module-not-installed, patched-version
Who cares media-streaming, nginx, self-hosted
nginx -V to see whether the flv module is compiled in.grep -r flv /etc/nginx.1.2.14 or later.nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.