CVE-2026-104774
Received Received - Intake

Null Byte Injection in OWASP Coraza WAF via JS Decode

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-104774

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
corazawaf coraza >= 3.0.0, < 3.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-172 The product does not properly encode or decode the data, resulting in unexpected values.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104774 is an off-by-one error in OWASP Coraza WAF's t:jsDecode transformation that mishandles JavaScript octal escape sequences. The backslash is incorrectly included in the octal buffer, causing ParseInt to return a null byte instead of the decoded value. This corruption allows attackers to bypass WAF rules by encoding malicious payloads in octal escapes (e.g., \163\143\162\151\160\164 for <script>). The WAF fails to decode these properly while the backend processes them normally, enabling attacks like XSS or SQL injection.

Detection Guidance

To detect this vulnerability, check your Coraza WAF version. If it is between 3.0.0 and 3.7.0, the system is vulnerable. Use commands like 'coraza-waf -v' or inspect package managers for version details. Monitor logs for WAF bypass attempts using JavaScript octal escape sequences (e.g., \163\143\162\151\160\164).

Test by sending crafted payloads with octal escapes to see if WAF rules fail to block them. Example: curl 'http://target.com/?param=\163\143\162\151\160\164' to check for XSS bypass.

Impact Analysis

If you use Coraza WAF versions 3.0.0 to 3.7.0, an attacker could bypass security rules and inject malicious payloads into your application. This could lead to unauthorized access, data theft, or defacement. The impact depends on the protected application's sensitivity and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage depending on the breach's severity and affected data.

Mitigation Strategies

Upgrade Coraza WAF to version 3.8.0 or later immediately. This version includes fixes for the octal parsing and jsDecode issues. Follow the official release notes for installation instructions.

Temporarily disable rules relying on t:jsDecode if upgrading is not feasible. Review and update WAF rules to account for JavaScript octal escapes in payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart