CVE-2026-104774
5.8MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-172, CWE-193, CWE-693
Impact
Unauthenticated remote attackers can bypass WAF inspection rules and hit your backend with payload types like XSS or SQL injection. They only need to send requests encoded with JavaScript octal escape sequences against endpoints guarded by t:jsDecode rules.
Root cause
The t:jsDecode transformation retains the leading backslash in its octal buffer, causing ParseInt to fail and incorrectly replace valid escaped characters with null bytes.
Affected systems
OWASP Coraza WAF versions 3.0.0 through 3.7.x (versions prior to 3.8.0)
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Fix & remediation
Upgrade the Coraza Go module to version 3.8.0 or later. If upgrading immediately is not possible, temporarily review and remove the t:jsDecode transformation from vulnerable inspection rules.
$ go get github.com/corazawaf/coraza/v3@v3.8.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.