CVE-2026-104774 Details
Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.
An off-by-one vulnerability has been identified in the OWASP Coraza WAF, specifically in versions 3.0.0 prior to 3.8.0. The issue arises in the 't:jsDecode' transformation, where JavaScript octal escape sequences are not processed correctly. This flaw allows an unauthenticated attacker to encode malicious payloads using octal escapes, which are then improperly decoded by Coraza. As a result, WAF rules relying on 't:jsDecode' can be bypassed, potentially exposing the protected application to attacks such as cross-site scripting or SQL injection.
Users can upgrade to Coraza WAF version 3.8.0 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, the specific code change can be applied manually.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2 | [email protected] | Source CodeVendor |
| https://github.com/corazawaf/coraza/releases/tag/v3.8.0 | [email protected] | Release NotesVendor |
| https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-172 | Encoding Error | [email protected] |
| CWE-193 | Off-by-one Error | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OWASP Coraza WAF | >= 3.0.0, < 3.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |