CVE-2026-93479

Heap buffer overflow in NGINX map regex handling

CVSS 4.0: 9.2 critical
EPSS: —
Published: Oct 14, 2026 · 11d ago
Modified: Oct 15, 2026

Analyze CVE-2026-93479 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

NGINX Open Source and NGINX Plus contain a heap buffer overflow (CWE-122) in the worker process when a map directive uses regex matching and root or an access-log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. An unauthenticated remote attacker can trigger it with crafted HTTP requests, but only when that configuration is already present—conditions the attacker does not control. Successful exploitation restarts the worker (denial of service) and can lead to code execution on systems where ASLR is disabled or can be bypassed; this is a data-plane issue only, with no control-plane exposure. Both NGINX Open Source and NGINX Plus are affected; exact version ranges were not published in the advisory data, and End of Technical Support releases were not evaluated. It is scored CVSS 4.0 9.2 (critical). It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the fixed NGINX Open Source and NGINX Plus builds from F5 as soon as they are available for your supported release; End of Technical Support versions were not evaluated. Until then, review configs for map blocks that use regex captures and for root or log_format (or other string expressions) that reference those capture variables before the map output variable, and remove or reorder that pattern. Keep ASLR enabled on NGINX hosts so a worker crash is limited to a restart rather than a realistic code-execution path.

Product	Affected
F5 NGINX Open Source	Affected versions not enumerated in the advisory data; releases past End of Technical Support were not evaluated
F5 NGINX Plus	Affected versions not enumerated in the advisory data; releases past End of Technical Support were not evaluated

Estimated exposure

unknown (only a configuration-specific subset of widely deployed NGINX installations is vulnerable) — Public web-server market surveys consistently show NGINX on a very large share of sites, but this flaw requires a specific map/regex capture variable order (or a non-cacheable variable in a string expression), and no public count of that…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness: CWE-122

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (—)