ZeroDay Findings
Sign inSign up

Findings

CVE-2026-84316

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Published Oct 15, 2026

config.ValidateConfigFile is the security control that blocks dangerous nginx directives (js_ , perl_ , load_module of njs/perl modules, user root). Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directives with ;, not newlines. Putting a benign directive first and the blocked directive after a ; on the SAME line defeats every check. The include directive is also …

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitLab Advisory Database

    Detected

    config.ValidateConfigFile is the security control that blocks dangerous nginx directives (js_ , perl_ , load_module of njs/perl modules, user root). Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directives with ;, not newlines. Putting a benign directive first and the blocked directive after a ; on the SAME

Affected

  • golang github.comversion unspecified

Sources

  • GitLab Advisory DatabasePackage advisoryCVE-2026-84316

    config.ValidateConfigFile is the security control that blocks dangerous nginx directives (js_ , perl_ , load_module of njs/perl modules, user root). Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directives with ;, not newlines. Putting a benign directive first and the blocked directive after a ; on the SAME

    advisories.gitlab.com