Description
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.
Published: 2026-10-09
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Availability/Denial of Service
Action: Patch
AI Analysis

Impact

A flaw in the nginx‑ui node‑signature authentication chain lets an unauthenticated remote client submit syntactically sound signature data so that the service temporarily stages the request body on disk before rejecting it. This causes arbitrary consumption of filesystem space, disk I/O, and CPU resources, leading to a complete denial of service but without compromising authentication, confidentiality, or integrity.

Affected Systems

The vulnerability exists in the 0xJacky nginx‑ui product for all releases from version 2.5.0 up to, but not including, the fixed release 2.6.0. Users should upgrade to 2.6.0 or later to eliminate the issue.

Risk and Exploitability

The CVSS score of 7.5 classifies the flaw as High severity. With no EPSS score available, the exact exploitation likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers can remotely exploit the path by targeting the publicly reachable API endpoint with crafted signature metadata, making the risk significant for exposed deployments.

Generated by OpenCVE AI on October 9, 2026 at 16:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade nginx‑ui to version 2.6.0 or later to apply the vendor patch.
  • Configure network controls or firewall rules to restrict external access to the nginx‑ui API, limiting exposure of the vulnerable endpoint.
  • If an immediate upgrade is not feasible, temporarily disable the node‑signature authentication feature or reduce the maximum allowed request body size to mitigate resource exhaustion.

Generated by OpenCVE AI on October 9, 2026 at 16:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.
Title Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-09T14:50:58.011Z

Reserved: 2026-10-08T21:23:59.820Z

Link: CVE-2026-107805

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-09T15:17:09.960

Modified: 2026-10-09T16:38:57.820

Link: CVE-2026-107805

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T16:30:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption