Live › vulnerability › CVE-2026-84319
Go to dashboardNginx UI, a web interface for managing Nginx, has an MCP configuration path that skips the directive checks the normal API enforces, so a secondary authenticated user can write restricted directives like load_module and js_content. That lets them run attacker-controlled NJS JavaScript inside the Nginx worker process after a reload.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | < 1.9.10-0.20260703131214-23d1934099b0 | 1.9.10-0.20260703131214-23d1934099b0 |
Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod against the affected range below 1.9.10-0.20260703131214-23d1934099b0.
1.9.10-0.20260703131214-23d1934099b0 or later; the description cites version 2.4.1 as the fix, which the sources do not reconcile with the Go module versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-84319")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.