Vulnerability in 0xjacky Nginx-ui
CVE-2026-34403
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijackin…
EPSS: 0.000 (13.4th percentile) — read the EPSS interpretation.
Affected products
- 0xjacky Nginx-ui — versions < 2.3.5
Weakness classification (CWE)
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj (x_refsource_CONFIRM)
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5 (x_refsource_MISC)