NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability

August 13th, 2026
ZDI-26-578 ZDI-CAN-29287

CVE ID

CVE-2026-27654

CVSS Score

8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

NGINX

Affected Products

NGINX

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of WebDAV requests. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account.

Additional Details

Fixed in version 1.29.7


Disclosure Timeline

  • 2026-03-06 - Vulnerability reported to vendor
  • 2026-08-13 - Coordinated public release of advisory
  • 2026-08-13 - Advisory Updated

Credit

Jeremy Brown

Back to Advisories