Provisional finding. Full causal and release verification remains incomplete.
nginx-ui 2.5.0 to 2.5.10 handled HMAC-signed node requests by first writing the whole body to a temporary file, with no size limit and an fsync, before verifying the signature. Every install has a node secret, so any network client could exhaust disk and workers. An earlier human-written path did this only after ID checks. Fixed in 2.6.0.
AI-assisted change
The AI-attributed change added an HMAC shared-secret branch keyed by the public node-secret sentinel. It extended an earlier human-written path that was gated by instance and credential IDs, and this branch staged bodies before checking digest or HMAC.
Root cause
Every install generates a node secret, so unauthenticated network clients could reach the body-staging path on AuthRequired and AuthRequiredWS routes. They could use temp storage, disk I/O and workers without a valid signature.
Fix
stageRequestBodyWithLimit now rejects declared oversize bodies without reading and caps unknown-length streams with LimitReader and an extra-byte check. The 128 MiB limit returns errRequestBodyTooLarge before temp files can grow without bound.
Case facts
ClaudeCite this finding
Vibe Security Radar, "CVE-2026-107805 in 0xJacky/nginx-ui," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-107805/
@@ -2,7 +2,10 @@ package nodeauth import ( "crypto/ed25519"+ "crypto/hkdf"+ "crypto/hmac" "crypto/rand"+ "crypto/sha256" "crypto/subtle" "encoding/base64" "errors"@@ -29,6 +32,16 @@ const ( signatureInputHeader = "Signature-Input" signatureHeader = "Signature" coveredComponentParameters = "(\"@method\" \"@path\" \"@query\" \"content-digest\" \"x-nginx-ui-credential-id\" \"x-nginx-ui-target-instance\")"++ signatureAlgorithmEd25519 = "ed25519"+ signatureAlgorithmHMAC = "hmac-sha256"++ // sharedSecretKeyID marks a signature keyed by the configured node secret+ // rather than by a paired credential. It fills both identifier slots of the+ // envelope because a shared secret is not bound to a credential record or to+ // one target instance.+ sharedSecretKeyID = "node-secret"+ sharedSecretKeyInfo = "nginx-ui/node-shared-secret/hmac-sha256/v1" ) var defaultReplayCache = NewReplayCache(maxReplayItems)@@ -38,13 +51,35 @@ type signatureMetadata struct { expires int64 nonce string credentialID string+ algorithm string parameters string } func SignRequestWithKey(request *http.Request, credentialID, targetInstanceID string, privateKey ed25519.PrivateKey, now time.Time) error { if len(privateKey) != ed25519.PrivateKeySize { return errors.New("invalid Ed25519 private key") }+ return signRequest(request, credentialID, targetInstanceID, signatureAlgorithmEd25519, now,+ func(base []byte) ([]byte, error) {+ return ed25519.Sign(privateKey, base), nil+ })+}++// SignRequestWithSharedSecret authenticates a request with the node secret both+// instances already hold, without ever putting that secret on the wire.+func SignRequestWithSharedSecret(request *http.Request, secret []byte, now time.Time) error {+ if len(secret) == 0 {+ return errors.New("node secret is unavailable")+ }+ return signRequest(request, sharedSecretKeyID, sharedSecretKeyID, signatureAlgorithmHMAC, now,+ func(base []byte) ([]byte, error) {+ return sharedSecretSignature(secret, base)+ })+}++func signRequest(request *http.Request, credentialID, targetInstanceID, algorithm string, now time.Time,+ sign func(base []byte) ([]byte, error),+) error { if !validIdentifier(credentialID) || !validIdentifier(targetInstanceID) { return errors.New("invalid node signature identifier") }@@ -63,12 +98,13 @@ func SignRequestWithKey(request *http.Request, credentialID, targetInstanceID st expires := now.Add(signatureLifetime).Unix() nonce := base64.RawURLEncoding.EncodeToString(nonceBytes) parameters := fmt.Sprintf(- "%s;created=%d;expires=%d;nonce=\"%s\";keyid=\"%s\";alg=\"ed25519\";tag=\"%s\"",+ "%s;created=%d;expires=%d;nonce=\"%s\";keyid=\"%s\";alg=\"%s\";tag=\"%s\"", coveredComponentParameters, created, expires, nonce, credentialID,+ algorithm, signatureTag, ) @@ -77,12 +113,25 @@ func SignRequestWithKey(request *http.Request, credentialID, targetInstanceID st request.Header.Set(CredentialIDHeader, credentialID) request.Header.Set(TargetInstanceHeader, targetInstanceID) request.Header.Set(signatureInputHeader, signatureLabel+"="+parameters)- signatureBase := buildSignatureBase(request, parameters)- signature := ed25519.Sign(privateKey, []byte(signatureBase))+ signature, err := sign([]byte(buildSignatureBase(request, parameters)))+ if err != nil {+ CloseStagedBody(request)+ return err+ }@@ -3,13 +3,20 @@ package nodeauth import ( "crypto/sha256" "encoding/base64"+ "errors" "fmt" "hash" "io" "net/http" "os" ) +// Keep signed node traffic within the bundled reverse proxy's upload limit,+// including deployments that expose the application server directly.+const maxStagedRequestBodySize int64 = 128 << 20++var errRequestBodyTooLarge = errors.New("node request body is too large")+ type temporaryRequestBody struct { *os.File path string@@ -28,10 +35,18 @@ func (body *temporaryRequestBody) Close() error { } func stageRequestBody(request *http.Request) (string, error) {+ return stageRequestBodyWithLimit(request, maxStagedRequestBodySize)+}++func stageRequestBodyWithLimit(request *http.Request, limit int64) (string, error) { digest := sha256.New() if request.Body == nil || request.Body == http.NoBody { return formatContentDigest(digest), nil }+ if request.ContentLength > limit {+ _ = request.Body.Close()+ return "", requestBodyTooLargeError(limit)+ } temporary, err := os.CreateTemp("", "nginx-ui-node-request-body-*") if err != nil {@@ -43,7 +58,19 @@ func stageRequestBody(request *http.Request) (string, error) { _ = os.Remove(path) } - size, err := io.Copy(io.MultiWriter(temporary, digest), request.Body)+ size, err := io.Copy(io.MultiWriter(temporary, digest), io.LimitReader(request.Body, limit))+ if err == nil {+ var extra int64+ extra, err = io.CopyN(io.Discard, request.Body, 1)+ if errors.Is(err, io.EOF) {+ err = nil+ }+ if extra > 0 {+ cleanup()+ _ = request.Body.Close()+ return "", requestBodyTooLargeError(limit)+ }+ } closeErr := request.Body.Close() if err != nil { cleanup()@@ -67,6 +94,10 @@ func stageRequestBody(request *http.Request) (string, error) { return formatContentDigest(digest), nil } +func requestBodyTooLargeError(limit int64) error {+ return fmt.Errorf("%w: limit is %d bytes", errRequestBodyTooLarge, limit)+}+ func formatContentDigest(digest hash.Hash) string { return "sha-256=:" + base64.StdEncoding.EncodeToString(digest.Sum(nil)) + ":" }AI-assisted change 44ff0c138c9e9c26938f3fccc8e4ef66bdb91c5757958155de30c694d30bdb3c · Fix f3d07f9a85ecf171cf2ca8a6c95e9317fa02a8acaf849762b74b217cc8f82af7
CVE-2026-107391Oct 8, 2026Borewit/music-metadata
TypeScriptClaudeDirect introductionResource abuse & availability
CVE-2026-107826Oct 8, 2026corazawaf/coraza
GoClaudeFlawed AI-written codeResource abuse & availability
HighGHSA-V53P-9FQP-M79JSep 11, 2026nodemailer/nodemailerTypeScriptClaudeIncomplete remediationResource abuse & availability
HighCVE-2026-90776Sep 11, 2026nodemailer/nodemailerTypeScriptClaudeDirect introductionResource abuse & availability
MediumGHSA-X4HG-HFWF-P9MWJul 2, 2026asymmetric-effort/nogginlessdomTypeScriptClaudeFlawed AI-written codeResource abuse & availability