CVE-2026-65982— NULL-pointer dereference (DoS) in nginx-http-flv-module

Quick assessment

Affected

winshining nginx-http-flv-module

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

nginx-http-flv-module 是一个基于 nginx-rtmp-module 的媒体流媒体服务器。在 1.2.14 版本之前，如果服务器收到一个未携带 Host 请求头的 HTTP/1.0 请求（该行为被 Nginx 核心允许），则 r->headers_in.host 将为 NULL；而 nginx-http-flv-module 在构造伪 tcUrl 时直接访问了 r->headers_in.host->value，从而引发空指针解引用漏洞。该问题已在 1.2.14 版本中修复。

CVSS 8.7 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NULL-pointer dereference (DoS) in nginx-http-flv-module

Source: CVE Program / CVE List V5

Vulnerability Description

nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
winshining	nginx-http-flv-module	< 1.2.14	-

II. Public POCs for CVE-2026-65982

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-65982

请登录查看更多情报信息。

Other References for CVE-2026-65982 (2)

https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-e4754e5af4f8?lang=en x_refsource_MISC
https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9 x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-65982

IV. Related Vulnerabilities

Same weakness: CWE-476