CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Risk score: 68/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.5%
Published: 9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can r…
Affected: github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21
Fix: Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260901043436-8c9b9a1aff21 or later.
Exploitation: No known exploitation

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: nginx, Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/0xJacky/Nginx-UI	go	>= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21	1.9.10-0.20260901043436-8c9b9a1aff21

References

Original description

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.

Last activity 9 Oct 2026. Patch Forecast updates every hour.