Is CVE-2026-84316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84316 being exploited in the wild.

How severe is CVE-2026-84316?

High severity, with a CVSS score of 8.8, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0; Uozi Nginx UI 2.3.11 and prior.

How is CVE-2026-84316 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84316?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Uozi Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84316: Nginx UI authenticated directive injection via ValidateConfigFile bypass

Q: Is there a fix for CVE-2026-84316?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Until then: Restrict access to nginx-ui to trusted administrators only; disable njs and perl modules in nginx unless explicitly required. Until a patch is available, audit active nginx configurations for injected directives and restrict node-secret and user JWT distribution. [{"kind": "disclosed", "at": "2026-10-15"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-84316 · Severity: high · CVSS 8.8 · Published 2026-10-12

Nginx UI, a web-based management interface for nginx reverse proxies, contains a flaw in its configuration validation that allows authenticated administrators to inject arbitrary nginx directives that should be blocked by security controls. On systems running nginx with JavaScript (njs) support—including the official Docker image—this enables remote code execution with nginx worker privileges; if the worker runs as root, attackers can read and modify any file on the system.

Technologies: github.com/0xJacky/Nginx-UI (Go), Uozi Nginx UI. Vendors: Go, Uozi.

Quick answers

Is CVE-2026-84316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84316 being exploited in the wild.
How severe is CVE-2026-84316?: High severity, with a CVSS score of 8.8, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260703131214-23d1934099b0, SEMVER:introduced=0,fixed=1.9.10-0.20260703131214-23d1934099b0; Uozi Nginx UI 2.3.11 and prior.
Is there a fix for CVE-2026-84316?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later. Until then: Restrict access to nginx-ui to trusted administrators only; disable njs and perl modules in nginx unless explicitly required. Until a patch is available, audit active nginx configurations for injected directives and restrict node-secret and user JWT distribution.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-15"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84316 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84316?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Uozi Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260703131214-23d1934099b0 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
```

Restrict access to nginx-ui to trusted administrators only; disable njs and perl modules in nginx unless explicitly required. Until a patch is available, audit active nginx configurations for injected directives and restrict node-secret and user JWT distribution.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-15"}]

Technical details

The ValidateConfigFile validator splits nginx configuration by newlines and checks only the first token per line, but nginx itself parses directives separated by semicolons. An attacker can place a benign directive followed by a semicolon and a blocked directive (e.g., `js_import`, `load_module`, or `user root`) on the same line to bypass all checks. The `include` directive is also not blocked, enabling file inclusion attacks. The vulnerability affects all configuration write paths that invoke the validator: REST endpoints, MCP tools, and site/stream save functions. On the official Docker image with ngx_http_js_module loaded, injected JavaScript directives execute in the nginx worker process context, allowing arbitrary code execution as root.

Affected products

uozi nginx-ui 2.3.11 and prior

Identifiers

CVE-2026-84316
GHSA-cf23-7qxj-xmhr
GO-2026-6782

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.