CVE-2026-107805

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.5.0 through 2.5.x

Description The node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client capable of reaching the API and providing syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before the request is rejected. This issue affects availability and may disrupt Nginx UI and other services sharing the same filesystem, though it does not bypass authentication or impact confidentiality and integrity.

Recommendations Upgrade to Nginx UI version 2.6.0 or later.