Buffer overflow and remote code execution affecting Nginx Open Source and Nginx Plus
A vulnerability affecting Nginx would allow an unauthenticated attacker to cause a denial of service or remotely execute code on affected systems.
Description
Technical context and vulnerability details
Nginx is a high-performance web server, reverse proxy and load balancer widely used for the deployment and security of web applications, available in community version (Nginx Open Source), as well as in commercial edition (Nginx Plus). This solution is affected by a vulnerability labeled CVE-2026-9256 resulting from the inadequate handling of layered Perl-compatible regular expression (PCRE) captures within the rewrite directive of the ngx_http_rewrite_module module. Exploitation of this vulnerability would allow an unauthenticated malicious actor to cause a heap-based buffer overflow in the NGINX worker process causing the latter to restart. In case ASLR is disabled or bypassable, this flaw also allows arbitrary code execution. It is classified high with a severity score of 8.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Denial of Service (DoS);
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- Nginx Open Source versions 1.31.0, 1.0.0 to 1.30.1 and 0.1.17 to 0.9.7;
- Nginx Plus versions 37.0.0 and R32 to R36;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Nginx (Open Source and More) to its latest stable version depending on the branch used;
- Update other products based on vulnerable Nginx components as soon as their respective patches are released by F5;
- If unable to update immediately, apply the temporary mitigation measure (present in the first reference);
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.