Vulnerability in 0xjacky Nginx-ui

CVE-2026-33028

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, co…

Vulnerability class: Race Condition

EPSS: 0.001 (25.9th percentile) — read the EPSS interpretation.

Affected products

0xjacky Nginx-ui — versions < 2.3.4

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m468-xcm6-fxg4 (x_refsource_CONFIRM)
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 (x_refsource_MISC)