Nginx UI EUVD-2026-95818

Requires network reachability to the Nginx UI node-signature authentication endpoint (the inter-node/clustering API) on an instance running 2.5.0 through pre-2.6.0. The attacker must supply syntactically valid signature metadata, but NOT a valid body digest or cryptographic signature, because the body is staged to a temporary file and synchronized to disk before those are validated - so no authentication, user interaction, or special configuration is needed to trigger staging. Limiting factors: exploitation depth depends on available temporary filesystem capacity and disk I/O headroom, and exposure is constrained by whether the node API is actually reachable by untrusted clients (e.g., multi-node deployments or instances with the application server exposed directly rather than behind a restricted reverse proxy); the fix also caps staged bodies at 128 MiB.

Signals are consistent in pointing to an easy-to-reach but impact-limited flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, which matches the description's statement that an unauthenticated client providing only syntactically valid signature metadata can trigger the staging behavior before any cryptographic validation. However, impact is strictly availability (C:N/I:N/A:H, CWE-400 resource exhaustion) - the advisory explicitly notes no authentication bypass, confidentiality, or integrity impact, so the 7.5 'High' score is driven entirely by the DoS dimension. No EPSS score, no CISA KEV listing, and no POC flag were supplied in the input, so exploitation probability and in-the-wild status cannot be quantified from available data; absence of these is not evidence of safety but should not be read as active exploitation either. Exposure is further gated by whether the node-signature/clustering API is network-reachable - in single-node deployments that endpoint may not be exposed. Net: a legitimate patch-worthy availability bug (trivial to exploit where the node API is reachable), but not a confidentiality/integrity emergency and, absent EPSS/KEV, not demonstrably under mass exploitation.

An unauthenticated attacker who can reach the Nginx UI node-signature API sends repeated or large request bodies accompanied by syntactically valid signature metadata. Because each body is staged to a temporary file and synchronized to disk before the digest and signature are validated, the attacker consumes temporary filesystem capacity, disk I/O, and request-processing resources and can degrade or crash the service. No public POC was identified in the provided data, though the fixing commit and GHSA advisory document the exact mechanism.