CVE-2026-84319

Received Received - Intake

Privilege Escalation in Nginx UI via NJS Module Loading

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84319

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Nginx UI before 2.4.1 has a flaw where the HTTP configuration API blocks restricted Nginx directives like load_module, but the MCP configuration interface allows authenticated users to bypass this restriction. This enables users to load malicious modules, import attacker-controlled JavaScript, and execute code in the Nginx worker context.

Detection Guidance

Check the installed version of Nginx UI. If it is below 2.4.1, the system is vulnerable. Run: nginx-ui --version or check the package manager for version details.

Impact Analysis

An authenticated user could exploit this to execute arbitrary JavaScript code within the Nginx worker process. This may lead to remote code execution, unauthorized access to data, or disruption of web services running on the server.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance breaches if exploited.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later immediately. Restrict access to the MCP configuration interface to trusted users only. Review and audit configuration changes made by secondary users.

Hi! I’m here to help you understand CVE-2026-84319. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70