V3: Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass (CVE-2026-104774)

The t:jsDecode transformation in Coraza WAF incorrectly handles octal escape sequences due to an off-by-one error in the code that copies characters into the buffer for parsing. Specifically, the backslash character is mistakenly included in the octal number buffer, causing strconv.ParseInt to fail and return a null byte instead of the correct decoded value. This flaw affects all octal escape sequences (\000 to \377), corrupting JS-escaped payloads and allowing attackers to bypass WAF rules that rely on jsDecode for normalization. Proof-of-concept tests demonstrate that payloads encoded with octal escapes bypass the WAF, while normal payloads are blocked. The vulnerability affects Coraza WAF versions 3.0.0 up to but not including 3.8.0 and has a CVSS 3.1 score of 5.8 (medium severity).

Attackers can bypass Coraza WAF rules that use the jsDecode transformation by encoding payloads with JavaScript octal escape sequences. This bypass can lead to successful cross-site scripting (XSS), SQL injection, or other injection attacks that the WAF would otherwise block. The vulnerability causes the WAF to misinterpret octal escapes as null bytes, preventing detection of malicious input patterns. No known exploits in the wild have been reported.

A fix is available and has been implemented in Coraza WAF version 3.8.0 and later. Users should upgrade to version 3.8.0 or newer to remediate this vulnerability. Until upgraded, be aware that WAF rules relying on jsDecode may be bypassed by octal-encoded payloads.