CVE-2026-33028: nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse

March 30, 2026

The nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination.

References

github.com/0xJacky/nginx-ui
github.com/0xJacky/nginx-ui/releases/tag/v2.3.4
github.com/0xJacky/nginx-ui/security/advisories/GHSA-m468-xcm6-fxg4
github.com/advisories/GHSA-m468-xcm6-fxg4
nvd.nist.gov/vuln/detail/CVE-2026-33028

Code Behaviors & Features

Detect and mitigate CVE-2026-33028 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →