Read the docs
TI-2026-22036 Aliases CVE-2026-27654GHSA-6r46-2qjx-j5j3

NGINX ngx_http_dav_module vulnerability

Priority HIGH 66CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.25942 97th percentileScored 2026-11-07
Fix Fixed NGINX Open Source (F5): 1.29.7, 1.28.3NGINX Plus (F5): R36 P3, R35 P2, R32 P5Red Hat: 15 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Open Source1.29.0 to before 1.29.7; 0.5.13 to before 1.28.31.29.7, 1.28.3Patch availableCNA
F5NGINX PlusR36 to before R36 P3; R35 to before R35 P2; R34 and later; R33 and later; R32 to before R32 P5R36 P3, R35 P2, R32 P5Patch availableCNA
  • NGINX Open Source VendorF5 Affected 1.29.0 to before 1.29.7; 0.5.13 to before 1.28.3 Fixed in 1.29.7, 1.28.3 Patch available CNA
  • NGINX Plus VendorF5 Affected R36 to before R36 P3; R35 to before R35 P2; R34 and later; R33 and later; R32 to before R32 P5 Fixed in R36 P3, R35 P2, R32 P5 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*r32 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:*r32 p2VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:*:*:*:*r32 p3VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:p4:*:*:*:*:*:*r32 p4VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:*:*:*:*:*:*:*r33VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*r33 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:*r33 p2VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:p3:*:*:*:*:*:*r33 p3VulnerableF5
cpe:2.3:a:f5:nginx_plus:r34:*:*:*:*:*:*:*r34VulnerableF5
cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:*r34 p1VulnerableF5
  • cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:* Versions r32 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:* Versions r32 p2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:*:*:*:* Versions r32 p3 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:p4:*:*:*:*:*:* Versions r32 p4 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:*:*:*:*:*:*:* Versions r33 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:* Versions r33 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:* Versions r33 p2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:p3:*:*:*:*:*:* Versions r33 p3 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r34:*:*:*:*:*:*:* Versions r34 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:* Versions r34 p1 Vulnerable ·F5
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_plus:r34:p2:*:*:*:*:*:*r34 p2VulnerableF5
cpe:2.3:a:f5:nginx_plus:r35:*:*:*:*:*:*:*r35VulnerableF5
cpe:2.3:a:f5:nginx_plus:r35:p1:*:*:*:*:*:*r35 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r36:*:*:*:*:*:*:*r36VulnerableF5
cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*r36 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:*r36 p2VulnerableF5
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*0.5.13 – 0.9.7; 1.0.0 to before 1.28.3; 1.29.0 to before 1.29.7VulnerableF5
  • cpe:2.3:a:f5:nginx_plus:r34:p2:*:*:*:*:*:* Versions r34 p2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r35:*:*:*:*:*:*:* Versions r35 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r35:p1:*:*:*:*:*:* Versions r35 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r36:*:*:*:*:*:*:* Versions r36 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:* Versions r36 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:* Versions r36 p2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* Versions 0.5.13 – 0.9.7; 1.0.0 to before 1.28.3; 1.29.0 to before 1.29.7 Vulnerable ·F5

Remediation

  • Fix · CNA NGINX Open Source (F5) Fixed in 1.29.7, 1.28.3
  • Fix · CNA NGINX Plus (F5) Fixed in R36 P3, R35 P2, R32 P5

Red Hat 15 advisories

  • RHSA-2026:15966 Released 2026-05-11 · Red Hat rating Important
    nginx:1.26 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nginx-2:1.26.3-1.module+el9.6.0+24255+10832c07.2.aarch64::nginx:1.26, nginx-2:1.26.3-1.module+el9.6.0+24255+10832c07.2.ppc64le::nginx:1.26, nginx-2:1.26.3-1.module+el9.6.0+24255+10832c07.2.s390x::nginx:1.26 +32
  • RHSA-2026:15945 Released 2026-05-11 · Red Hat rating Important
    nginx:1.24 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nginx-1:1.24.0-4.module+el9.6.0+24259+49d2cefe.2.aarch64::nginx:1.24, nginx-1:1.24.0-4.module+el9.6.0+24259+49d2cefe.2.ppc64le::nginx:1.24, nginx-1:1.24.0-4.module+el9.6.0+24259+49d2cefe.2.s390x::nginx:1.24 +32
  • RHSA-2026:15943 Released 2026-05-11 · Red Hat rating Important
    nginx:1.24 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) nginx-1:1.24.0-1.module+el9.4.0+24260+3e6db809.4.aarch64::nginx:1.24, nginx-1:1.24.0-1.module+el9.4.0+24260+3e6db809.4.ppc64le::nginx:1.24, nginx-1:1.24.0-1.module+el9.4.0+24260+3e6db809.4.s390x::nginx:1.24 +32
Show 12 more Red Hat advisories
  • RHSA-2026:15942 Released 2026-05-11 · Red Hat rating Important
    nginx security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) nginx-1:1.20.1-10.el9_0.3, nginx-all-modules-1:1.20.1-10.el9_0.3, nginx-filesystem-1:1.20.1-10.el9_0.3 +5
  • RHSA-2026:14836 Released 2026-05-07 · Red Hat rating Important
    nginx security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) nginx-1:1.20.1-14.el9_2.5, nginx-all-modules-1:1.20.1-14.el9_2.5, nginx-core-1:1.20.1-14.el9_2.5 +6
  • RHSA-2026:13839 Released 2026-05-05 · Red Hat rating Important
    nginx security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) nginx-mod-devel-1:1.20.1-16.el9_4.5
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) nginx-1:1.20.1-16.el9_4.5, nginx-all-modules-1:1.20.1-16.el9_4.5, nginx-core-1:1.20.1-16.el9_4.5 +6
  • RHSA-2026:13680 Released 2026-05-05 · Red Hat rating Important
    nginx security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) nginx-mod-devel-2:1.20.1-22.el9_6.5
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nginx-2:1.20.1-22.el9_6.5, nginx-all-modules-2:1.20.1-22.el9_6.5, nginx-core-2:1.20.1-22.el9_6.5 +6
  • RHSA-2026:13634 Released 2026-05-05 · Red Hat rating Important
    nginx security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nginx-2:1.26.3-1.el10_0.8, nginx-all-modules-2:1.26.3-1.el10_0.8, nginx-core-2:1.26.3-1.el10_0.8 +6
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) nginx-mod-devel-2:1.26.3-1.el10_0.8
  • RHSA-2026:10065 Released 2026-04-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:8346 Released 2026-04-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nginx-1.30.0-1.hum1@aarch64, nginx-1.30.0-1.hum1@src, nginx-1.30.0-1.hum1@x86_64 +22
  • RHSA-2026:7343 Released 2026-04-09 · Red Hat rating Important
    nginx:1.26 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nginx-2:1.26.3-2.module+el9.7.0+24173+4204b761.1.aarch64::nginx:1.26, nginx-2:1.26.3-2.module+el9.7.0+24173+4204b761.1.ppc64le::nginx:1.26, nginx-2:1.26.3-2.module+el9.7.0+24173+4204b761.1.s390x::nginx:1.26 +32
  • RHSA-2026:7002 Released 2026-04-08 · Red Hat rating Important
    nginx security update
    • Red Hat Enterprise Linux AppStream (v. 9) nginx-2:1.20.1-24.el9_7.2, nginx-core-2:1.20.1-24.el9_7.2, nginx-mod-mail-2:1.20.1-24.el9_7.2
  • RHSA-2026:6923 Released 2026-04-07 · Red Hat rating Important
    nginx:1.24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nginx-1:1.24.0-5.module+el9.7.0+24151+c43a3acf.2.aarch64::nginx:1.24, nginx-1:1.24.0-5.module+el9.7.0+24151+c43a3acf.2.ppc64le::nginx:1.24, nginx-1:1.24.0-5.module+el9.7.0+24151+c43a3acf.2.s390x::nginx:1.24 +32
  • RHSA-2026:6907 Released 2026-04-07 · Red Hat rating Important
    nginx:1.24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nginx-1:1.24.0-3.module+el8.10.0+24155+8a5ade52.aarch64::nginx:1.24, nginx-1:1.24.0-3.module+el8.10.0+24155+8a5ade52.ppc64le::nginx:1.24, nginx-1:1.24.0-3.module+el8.10.0+24155+8a5ade52.s390x::nginx:1.24 +28
  • RHSA-2026:6906 Released 2026-04-07 · Red Hat rating Important
    nginx security update
    • Red Hat Enterprise Linux AppStream (v. 10) nginx-2:1.26.3-2.el10_1.1, nginx-core-2:1.26.3-2.el10_1.1, nginx-mod-mail-2:1.26.3-2.el10_1.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Open Source 1.28.3, 1.29.7

    6 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-22033 NGINX ngx_mail_auth_http_module vulnerabilityPriority MEDIUM 45
    • TI-2026-25155 NGINX ngx_http_mp4_module vulnerabilityPriority MEDIUM 41
    • TI-2026-22141 NGINX ngx_http_mp4_module vulnerabilityPriority MEDIUM 41
    Show all 6 records →
  • Release ·

    F5 NGINX Plus R32 P5, R35 P2, R36 P3

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-22033 NGINX ngx_mail_auth_http_module vulnerabilityPriority MEDIUM 45
    • TI-2026-25155 NGINX ngx_http_mp4_module vulnerabilityPriority MEDIUM 41
    • TI-2026-22952 NGINX ngx_mail_proxy_module vulnerabilityPriority LOW 28
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:13839
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:13680
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:6906
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:6907
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:6923, RHSA-2026:7002, RHSA-2026:7343
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:15942
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:14836
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:13634
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:13839, RHSA-2026:15943
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:13680, RHSA-2026:15945, RHSA-2026:15966
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:13634
Red Hat Hardened ImagesFixed RHSA-2026:8346
Red Hat Update Infrastructure 5Fixed RHSA-2026:10065
Not affected: 5 products
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27654
  2. 2026-10-03 Alias added: GHSA-6r46-2qjx-j5j3

References

Advisory 1

  • TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-42786 NGINX ngx_http_slice_module vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-22033 NGINX ngx_mail_auth_http_module vulnerability CVSS 4.0HIGH 8.7
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences