NGINX: Heap buffer overflow in map directive with regex captures
Summary
A heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered when a regex-based map directive's capture variables are referenced in the root directive or access log format before the map output variable, or through a non-cacheable variable in a string expression under certain conditions. An unauthenticated remote attacker can send crafted HTTP requests to crash NGINX worker processes, which causes denial of service. With ASLR disabled or bypassed, code execution may also be possible. The research notes describe this as a regression from the fix for CVE-2026-42533.
Affected
- NGINX Open Source 1.31.2 to before 1.31.7\n- NGINX Open Source 1.30.0 to before 1.30.6\n- NGINX Plus 37.1.0 to before 37.1.0.1\n- NGINX Plus 37.0.0 to before 37.0.5.1\n- NGINX Plus R36, R35, R34 and R33 (no fixed release listed in the sources)\n- Versions that have reached End of Technical Support are not evaluated by F5.
Fixed in
- NGINX Open Source 1.30.6 and 1.31.7 (per the affected ranges in the CVE record and secondary sources)\n- NGINX Plus 37.1.0.1 and 37.0.5.1\n- Unknown for NGINX Plus R33 to R36 and for NGINX Ingress Controller and F5 WAF/DoS for NGINX; check the F5 advisory.
Workaround
- Do not use unnamed captures in regex map directives. Use named captures and limit their use to the block with the regex match.\n- Keep ASLR enabled. This reduces the code execution risk but does not prevent the crash.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total.\n- No reports of in-the-wild exploitation and no public proof of concept found at the time of research.\n- Exploitation requires a specific configuration and conditions outside the attacker's control.
Our recommendation
- Update NGINX Open Source to 1.30.6 or 1.31.7 and NGINX Plus to 37.1.0.1 or 37.0.5.1, or a newer release. Note that 1.30.4 and 1.31.3 are still affected.\n- Check whether your configuration uses regex map directives with captures in root or log_format. If patching is not possible, apply the named capture workaround.\n- Check the F5 advisory for fixed releases of NGINX Plus R33 to R36, the Ingress Controller and F5 WAF/DoS.\n- Monitor for repeated worker restarts in error logs, as sustained crafted requests can cause service disruption.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F5 Security Advisory K000162607 my.f5.com
- Red Hat CVE record CVE-2026-93479 access.redhat.com
- NGINX security advisories nginx.org
- Debian Security Tracker CVE-2026-93479 security-tracker.debian.org
- Vulners VulnRichment CVE-2026-93479 vulners.com
- OpenCVE CVE-2026-93479 app.opencve.io
- The Hacker News: NGINX vulnerability can crash servers (July 2026) thehackernews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:34.
Original description (NVD)
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.