ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.
ZDI advisory ZDI-26-578 describes an integer underflow in the alias directive of the NGINX HTTP Dav module that allows remote attackers to execute arbitrary code. Authentication is not required to exploit the vulnerability. ZDI rated the issue 8.1 on CVSS and assigned CVE-2026-27654.
- Unauthenticated remote code execution in the NGINX HTTP Dav module.
- Affects the alias directive via an integer underflow.
- CVSS 8.1; tracked as CVE-2026-27654 under ZDI-26-578.
- CVEs
- CVE-2026-27654
- Vendors
- NGINXZero Day Initiative
- Products
- NGINX
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-27654 | Buffer Overflow in NGINX ngx_http_dav_module via DAV MOVE/COPY with Alias | 8.8 | 25% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.