Skip to content
OpenAdvisories
High · 8.7 CVE-2026-65982 EUVD-2026-124035

NULL-pointer dereference (DoS) in nginx-http-flv-module

Published Nov 11, 2026 · Updated Nov 12, 2026 · Assigned by GitHub_M

Description

nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14.

Affected products

VendorProductAffectedFixed
winshining nginx-http-flv-module < 1.2.14 —

References