Read the docs
TI-2026-70056 Aliases CVE-2026-107805GHSA-j3hg-9rp3-5hw9

Nginx UI lets unauthenticated clients exhaust temporary storage

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Nginx UI from 2.5.0 before 2.6.0 stages attacker-controlled request bodies to temporary files in its node-signature authentication path before validating them. This is uncontrolled resource consumption (CWE-400). An unauthenticated remote client that can reach the API and send syntactically valid signature metadata can consume temporary disk space, disk input and output, and request-processing resources before rejection. The issue affects availability only and does not bypass authentication.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Fixed nginx-ui (0xJacky): 2.6.0github.com/0xJacky/Nginx-UI (Go): 1.9.10-0.20260901043436-8c9b9a1aff21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-ui2.5.0 to before 2.6.02.6.0Patch availableCNA
—github.com/0xJacky/Nginx-UI (Go)1.9.10-0.20260729084040-acb59fdd81db to before 1.9.10-0.20260901043436-8c9b9a1aff211.9.10-0.20260901043436-8c9b9a1aff21Patch availableGHSA-j3hg-9rp3-5hw9
  • nginx-ui Vendor0xJacky Affected 2.5.0 to before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • github.com/0xJacky/Nginx-UI (Go) Vendor— Affected 1.9.10-0.20260729084040-acb59fdd81db to before 1.9.10-0.20260901043436-8c9b9a1aff21 Fixed in 1.9.10-0.20260901043436-8c9b9a1aff21 Patch available GHSA-j3hg-9rp3-5hw9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*2.5.0 to before 2.6.0Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.6.0 Vulnerable ·0xJacky

Remediation

Update Nginx UI to version 2.6.0. Update the Go module github.com/0xJacky/Nginx-UI to 1.9.10-0.20260901043436-8c9b9a1aff21.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.6.0
  • Fix · GHSA-j3hg-9rp3-5hw9 github.com/0xJacky/Nginx-UI (Go) Fixed in 1.9.10-0.20260901043436-8c9b9a1aff21 Advisory →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107805
  2. 2026-10-10 Alias added: GHSA-j3hg-9rp3-5hw9
  3. 2026-10-10 Fix available: Go/github.com/0xJacky/[email protected] · GHSA-j3hg-9rp3-5hw9
  4. 2026-10-10 CVSS score added · GHSA-j3hg-9rp3-5hw9
  5. 2026-10-10 Weakness changed · GHSA-j3hg-9rp3-5hw9
  6. 2026-10-10 5 new references · GHSA-j3hg-9rp3-5hw9
  7. 2026-10-11 Priority changed: MEDIUM → LOW
  8. 2026-10-13 CISA SSVC decision points changed

References

Patch 1

Advisory 2

Other 2

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences