CWE-76Base

Improper Neutralization of Equivalent Special Elements

Draft in the CWE catalog · 14 CVEs mapped

14
CVEs mapped
8.2
Median CVSS
What it is

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

Recent examples
8.3cvss
CVE-2026-77180

CVE-2026-77180 - HIGH Severity Vulnerability

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

HIGHno explanation yet
0%
epss
8.1cvss
CVE-2026-66362

CVE-2026-66362 - HIGH Severity Vulnerability

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping. Impact: An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.

HIGHno explanation yet
0%
epss
8.7cvss
CVE-2026-54722

dssrf: there a critical security bug with remove_at_symbol_in_string

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.

HIGHno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-76
Abstraction
Base
Structure
Simple
Status
Draft