CVE-2026-65982: NULL-pointer dereference (DoS) in nginx-http-flv-module
nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headersin.host was NULL, nginx-http-flv-module used r->headersin.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nginx-http-flv-moduleto a version that resolves this vulnerability.Fixed in 1.2.14
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using nginx-http-flv-module versions prior to 1.2.14 are affected when they accept an HTTP/1.0 request that omits the Host header.
What does an attacker need to exploit this issue?
An attacker only needs network access to send a crafted HTTP/1.0 request without a Host header. No privileges or user interaction are required.
What is the impact of a successful exploit?
The malformed request can trigger a NULL-pointer dereference in nginx-http-flv-module, resulting in a denial of service.
How can I remediate or reduce exposure?
Upgrade nginx-http-flv-module to version 1.2.14, which contains the patch. If an upgrade cannot be performed immediately, prevent HTTP/1.0 requests without a Host header from reaching the module.