MEDIUM 5.8 GitHub
CVE-2026-104774
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
### Summary
The `t:jsDecode` transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences. A backslash character was incorrectly included in the octal number buffer, causing `strconv.ParseInt` to fail for every octal escape sequence and return a null byte instead of the decoded value that would normally be returned. This will cause all JS-escaped payloads to be corrupted, thus leading to the bypassing of these WAF rules when WAF rules that rely on `jsDecode` for
Affected Products
- go/github.com/corazawaf/coraza/v3 >= 3.0.0, < 3.8.0
References
- https://github.com/advisories/GHSA-pc5q-qfxp-ggqv
- https://github.com/corazawaf/coraza/security/advisories/GHSA-pc5q-qfxp-ggqv
- https://github.com/corazawaf/coraza/commit/f9b7afdbcedce7ad814663eaee2e342578ea3bb2
- https://github.com/corazawaf/coraza/releases/tag/v3.8.0
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-10-08 via GitHub. Affected: go/github.com/corazawaf/coraza/v3 >= 3.0.0, < 3.8.0.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.