CVE 追蹤：核心（nginx/OpenResty、TLS、HTTP/2/3、WAF、快取）

[CRITICAL 9.2] CVE-2026-111497 — Brotli

Thu, 22 Oct 2026 19:17:35 +0000

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVSS 4.0：9.2 CRITICAL（CNA）
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE：CWE-252, CWE-787
比對：Brotli（關鍵字 Google Brotli）
NVD 狀態：Awaiting Analysis｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high

[HIGH 7.5] CVE-2026-107826 — Coraza

Fri, 16 Oct 2026 17:16:41 +0000

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-674
比對：Coraza（關鍵字 \bCoraza\b）
NVD 狀態：Awaiting Analysis｜發布 2026-10-09｜最後修改 2026-10-16T17:16

參考連結：

[HIGH 7.2] CVE-2026-41510 — Coraza, WAF bypass

Fri, 16 Oct 2026 16:00:33 +0000

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.

CVSS 3.1：7.2 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
CWE：CWE-693, CWE-770
比對：Coraza（關鍵字 \bCoraza\b）；WAF bypass（關鍵字 \bWAF bypass\b|bypass (the )?(web application firewall|WAF)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-12｜最後修改 2026-10-16T16:00

參考連結：

[HIGH 8.3] CVE-2026-97629 — nginx

Thu, 15 Oct 2026 17:17:33 +0000

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0：8.3 HIGH（CNA）
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CWE：CWE-908
比對：nginx（關鍵字 NGINX (Plus|Open Source)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-14｜最後修改 2026-10-15T17:17

參考連結：

https://my.f5.com/manage/s/article/K000162606

[HIGH 8.3] CVE-2026-101019 — nginx

Thu, 15 Oct 2026 17:17:08 +0000

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0：8.3 HIGH（CNA）
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CWE：CWE-436
比對：nginx（關鍵字 NGINX JavaScript|\bnjs\b）
NVD 狀態：Awaiting Analysis｜發布 2026-10-14｜最後修改 2026-10-15T17:17

參考連結：

https://my.f5.com/manage/s/article/K000162615

[CRITICAL 9.2] CVE-2026-97205 — nginx

Thu, 15 Oct 2026 11:18:08 +0000

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0：9.2 CRITICAL（CNA）
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE：CWE-416
比對：nginx（關鍵字 NGINX (Plus|Open Source)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-14｜最後修改 2026-10-15T11:18

參考連結：

https://my.f5.com/manage/s/article/K000162608

[CRITICAL 9.2] CVE-2026-93479 — nginx

Thu, 15 Oct 2026 11:18:08 +0000

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0：9.2 CRITICAL（CNA）
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE：CWE-122
比對：nginx（關鍵字 NGINX (Plus|Open Source)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-14｜最後修改 2026-10-15T11:18

參考連結：

https://my.f5.com/manage/s/article/K000162607

[CRITICAL 9.2] CVE-2026-15176 — nginx

Thu, 15 Oct 2026 11:17:28 +0000

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0：9.2 CRITICAL（CNA）
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE：CWE-122
比對：nginx（關鍵字 NGINX (Plus|Open Source)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-14｜最後修改 2026-10-15T11:17

參考連結：

https://my.f5.com/manage/s/article/K000162416