The vulnerability is an off‑by‑one flaw in the jsDecode transformation used by Coraza WAF. When the transformation encounters a backslash inside a JavaScript octal escape, it incorrectly includes the backslash in the buffer, causing ParseInt to produce a null byte in the decoded output. If a rule relies on jsDecode, the WAF then inspects a corrupted null‑byte sequence while the underlying application receives the originally intended bytes. This mismatch allows an attacker to embed malicious payloads using octal escapes that are not detected by the WAF, potentially leading to cross‑site scripting or SQL injection attacks. The weakness can be classified as an input handling error that enables attacker supplied data to bypass security controls. The CVE lists CWE‑172, CWE‑193 and CWE‑693 as relevant weaknesses.

The issue affects all Coraza WAF installations running version 3.0.0 through 3.8.0 inclusive. Version 3.8.0, released in the referenced GitHub tag, address the bug by correcting the jsDecode logic. Any instance of Coraza deployed in a production environment that relies on the t:jsDecode transformation and hosts the vulnerable rule set should be considered affected.

The vulnerability has a CVSS score of 5.8, indicating moderate severity. The EPSS score is not available and the defect is not listed in CISA KEV. An attacker does not need any special privileges or authentication; the flaw can be triggered via arbitrary HTTP requests that include JavaScript octal escapes in a part of the request that is hashed by a jsDecode rule. Because the attacker only needs to craft a request payload, the risk of successful exploitation is non‑negligible in environments where the rules are actively used while not yet upgraded. In the absence of a patch, the flaw represents a direct bypass of WAF protection and may lead to data exfiltration or injection attacks.