{"id":"CVE-2026-65982","kind":"vulnerability","aliases":["CVE-2026-65982"],"related":[],"title":"nginx-http-flv-module: missing Host header causes a NULL-pointer crash","description":"nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14.","summary":"nginx-http-flv-module, a media streaming module for nginx, dereferences a NULL pointer when an HTTP/1.0 request arrives without a Host header. The crash can take down the nginx worker process, and the advisory's CVSS score is 8.7.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nginx-http-flv-module","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["media-streaming","nginx","runtime","self-hosted"],"not_affected_if":["module-not-installed","patched-version"],"how_to_check":"- Check the installed module version in the nginx build or package manager, e.g. `nginx -V` to see whether the flv module is compiled in.\n- Look for the module in the nginx configuration with `grep -r flv /etc/nginx`.","fix":"- nginx-http-flv-module: upgrade to `1.2.14` or later.","status":"open","published_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","triaged_at":"2026-11-11T21:30:36+00:00","updated_at":"2026-11-11T21:30:36+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T21:30:36Z","model":"claude-haiku-5-5","output":{"fix":"- nginx-http-flv-module: upgrade to `1.2.14` or later.","reach":"internet","title":"nginx-http-flv-module: missing Host header causes a NULL-pointer crash","impact":"medium","summary":"nginx-http-flv-module, a media streaming module for nginx, dereferences a NULL pointer when an HTTP/1.0 request arrives without a Host header. The crash can take down the nginx worker process, and the advisory's CVSS score is 8.7.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["nginx","self-hosted","media-streaming"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"remote requests crash the nginx worker process repeatedly","analyst_note":"Confirm the affected version range and the crash-only versus code-execution impact from the vendor advisory at github.com.","how_to_check":"- Check the installed module version in the nginx build or package manager, e.g. `nginx -V` to see whether the flv module is compiled in.\n- Look for the module in the nginx configuration with `grep -r flv /etc/nginx`.","plain_action":"","product_name":"nginx-http-flv-module","needs_analyst":true,"not_affected_if":["module-not-installed","patched-version"],"who_is_affected":"Servers that run nginx with the nginx-http-flv-module for live FLV or RTMP-style streaming are exposed, because an unauthenticated HTTP/1.0 request with no Host header reaches the vulnerable code. Nginx setups without this module are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4617,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-65982':17A,20A '1.2.14':94C,146C '8.7':74B 'advisori':69B 'arriv':53B 'base':85C 'caus':9A 'core':111C 'crash':14A,59B 'cve':15A,18A 'cvss':71B 'derefer':45B,137C 'flv':4A,24A,37B,78C,122C 'happen':138C 'header':8A,57B,104C 'headers_in.host':116C,126C 'host':7A,33B,56B,105C 'http':3A,23A,36B,77C,110C,121C 'http/1.0':51B,100C 'issu':140C 'make':129C 'media':27B,40B,82C 'media-stream':26B 'miss':6A 'modul':5A,38B,42B,79C,90C,123C 'module':25A 'nginx':2A,22A,29B,35B,44B,64B,76C,88C,113C,120C 'nginx-http-flv-modul':1A,34B,75C,119C 'nginx-http-flv-module':21A 'nginx-rtmp-modul':87C 'null':12A,47B,118C,135C 'null-point':11A,134C 'patch':143C 'permit':108C 'pointer':13A,48B,136C 'prior':91C 'process':66B 'pseudo':131C 'r':115C,125C 'receiv':98C 'request':52B,101C 'rtmp':89C 'runtim':30B 'score':72B 'self':32B 'self-host':31B 'server':84C,97C 'stream':28B,41B,83C 'take':61B 'tcurl':132C 'use':124C 'valu':127C 'version':93C,145C 'without':54B,102C 'worker':65B","nicknames":[],"mitigations":[],"who_affected":"Servers that run nginx with the nginx-http-flv-module for live FLV or RTMP-style streaming are exposed, because an unauthenticated HTTP/1.0 request with no Host header reaches the vulnerable code. Nginx setups without this module are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nginxhttpflvmodule"],"ptokens":["flv","http","module","nginx"],"labels":["high","mediastreaming","nginx","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-65982':17A,20A 'caus':9A 'crash':14A 'cve':15A,18A 'flv':4A,24A 'header':8A 'host':7A 'http':3A,23A 'miss':6A 'modul':5A 'module':25A 'nginx':2A,22A 'nginx-http-flv-modul':1A 'nginx-http-flv-module':21A 'null':12A 'null-point':11A 'pointer':13A","search_b":"'8.7':74B 'advisori':69B 'arriv':53B 'crash':59B 'cvss':71B 'derefer':45B 'flv':37B 'header':57B 'host':33B,56B 'http':36B 'http/1.0':51B 'media':27B,40B 'media-stream':26B 'modul':38B,42B 'nginx':29B,35B,44B,64B 'nginx-http-flv-modul':34B 'null':47B 'pointer':48B 'process':66B 'request':52B 'runtim':30B 'score':72B 'self':32B 'self-host':31B 'stream':28B,41B 'take':61B 'without':54B 'worker':65B","search_c":"'1.2.14':94C,146C 'base':85C 'core':111C 'derefer':137C 'flv':78C,122C 'happen':138C 'header':104C 'headers_in.host':116C,126C 'host':105C 'http':77C,110C,121C 'http/1.0':100C 'issu':140C 'make':129C 'media':82C 'modul':79C,90C,123C 'nginx':76C,88C,113C,120C 'nginx-http-flv-modul':75C,119C 'nginx-rtmp-modul':87C 'null':118C,135C 'null-point':134C 'patch':143C 'permit':108C 'pointer':136C 'prior':91C 'pseudo':131C 'r':115C,125C 'receiv':98C 'request':101C 'rtmp':89C 'server':84C,97C 'stream':83C 'tcurl':132C 'use':124C 'valu':127C 'version':93C,145C 'without':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T05:45:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65982","severity":null,"published_at":"2026-11-11T21:16:46+00:00","modified_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","fetched_at":"2026-11-11T21:29:09+00:00","note":null}],"documents":[{"id":129017,"url":"https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T05:45:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}