Nginx UI Vulnerability in Node-Signature Authentication for Web Server

CVE-2026-107805

What is CVE-2026-107805?

The Nginx UI has a vulnerability that affects versions 2.5.0 through 2.6.0, where the node-signature authentication mechanism improperly handles temporary file staging of a request body controlled by an attacker. An unauthenticated remote client can exploit this by sending valid signature metadata, leading to excessive consumption of temporary filesystem resources and impacting the availability of the server. This issue does not compromise the authentication, confidentiality, or integrity of the system, but it can severely affect system performance due to resource exhaustion. The vulnerability has been addressed in version 2.6.0.

References