CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
An off-by-one error in OWASP Coraza WAF's jsDecode transformation allows attackers to bypass security rules using JavaScript octal escapes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104774?
CVE-2026-104774 is a medium-severity vulnerability in corazawaf coraza, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.
Which versions are affected by CVE-2026-104774?
5 open source packages ship an affected version, including github.com/corazawaf/coraza/v3, github.com/corazawaf/coraza and github.com/corazawaf/coraza/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/corazawaf/coraza/v3 Go | From 3.0.0 | 3.8.0 |
github.com/corazawaf/coraza/v3 Go | From 3.0.0 | 3.8.0 |
github.com/corazawaf/coraza/v3 Go | From 3.0.0 | 3.8.0 |
github.com/corazawaf/coraza Go | All versions | None |
github.com/corazawaf/coraza/v2 Go | All versions | None |
How do I fix CVE-2026-104774?
Upgrade github.com/corazawaf/coraza/v3 to 3.8.0 or later.
Is CVE-2026-104774 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104774 exists.
Sources
Also known as GHSA-pc5q-qfxp-ggqv, GO-2026-6696.