Null Pointer Dereference in nginx-http-flv-module Affects Media Streaming Functionality
CVE-2026-65982

8.7HIGH

Key Information:

Vendor

Winshining

Status
Nginx-http-flv-module
Vendor
CVE Published:
11 November 2026

What is CVE-2026-65982?

The nginx-http-flv-module, built on the nginx-rtmp-module framework, is susceptible to a null pointer dereference issue. This vulnerability arises when the module processes an HTTP/1.0 request lacking a 'Host' header, a scenario allowed by the Nginx HTTP core. In such cases, the r->headers_in.host variable is set to NULL. Consequently, the nginx-http-flv-module attempts to access this NULL pointer to construct a pseudo 'tcUrl', resulting in a dereference failure. This flaw has been resolved in version 1.2.14.

Affected Version(s)

nginx-http-flv-module < 1.2.14

References

https://github.com/winshining/nginx-http-flv-module/secur...
x_refsource_CONFIRM
https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.