ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability

Published Aug 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-27654.

Affected Software

1 affected component

nginx

Event History

Aug 13, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-26-578?

ZDI-26-578 has a CVSS rating of 8.1, indicating a high severity level.

How do I fix ZDI-26-578?

To mitigate ZDI-26-578, update NGINX to the latest version that addresses this vulnerability.

What types of attacks can leverage ZDI-26-578?

ZDI-26-578 can be exploited by remote attackers to execute arbitrary code without requiring authentication.

Which software is affected by ZDI-26-578?

NGINX is the software affected by the ZDI-26-578 vulnerability.

What is the nature of the ZDI-26-578 vulnerability?

ZDI-26-578 is an integer underflow vulnerability in the NGINX HTTP Dav Module.

ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of ZDI-26-578?

How do I fix ZDI-26-578?

What types of attacks can leverage ZDI-26-578?

Which software is affected by ZDI-26-578?

What is the nature of the ZDI-26-578 vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of ZDI-26-578?

How do I fix ZDI-26-578?

What types of attacks can leverage ZDI-26-578?

Which software is affected by ZDI-26-578?

What is the nature of the ZDI-26-578 vulnerability?