NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability (CVE-2026-27654)

CVE number – CVE-2026-27654

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NGINX.

Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of WebDAV requests.

The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory.

An attacker can leverage this vulnerability to execute code in the context of the service account.

This issue has been fixed in version 1.29.7

I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.