Read the docs
TI-2026-74056 Aliases CVE-2026-93479GHSA-v72q-v4vf-2mx7

Heap buffer overflow in NGINX map directive regex matching

Priority MEDIUM 44CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

NGINX Plus from 37.0.0 before 37.0.5.1 and from 37.1.0 before 37.1.0.1, and NGINX Open Source from 1.30.0 before 1.30.6 and from 1.31.2 before 1.31.7, are affected. A map capture is referenced before the map output variable in the root directive or access log format, causing a heap buffer overflow (CWE-122). An unauthenticated remote attacker can trigger it with crafted HTTP requests, crashing the worker process. Code execution may be possible when ASLR is disabled or bypassed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact:  This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01198 68th percentileScored 2026-11-07
Fix Partial NGINX Plus (F5): 37.1.0.1, 37.0.5.1NGINX Open Source (F5): 1.31.7, 1.30.6Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Plus37.1.0 to before 37.1.0.1; 37.0.0 to before 37.0.5.1; R36 and later; R35 and later; R34 and later; R33 and later37.1.0.1, 37.0.5.1Patch availableCNA
F5NGINX Open Source1.31.2 to before 1.31.7; 1.30.0 to before 1.30.61.31.7, 1.30.6Patch availableCNA
  • NGINX Plus VendorF5 Affected 37.1.0 to before 37.1.0.1; 37.0.0 to before 37.0.5.1; R36 and later; R35 and later; R34 and later; R33 and later Fixed in 37.1.0.1, 37.0.5.1 Patch available CNA
  • NGINX Open Source VendorF5 Affected 1.31.2 to before 1.31.7; 1.30.0 to before 1.30.6 Fixed in 1.31.7, 1.30.6 Patch available CNA

Remediation

Upgrade NGINX Plus to 37.0.5.1 or 37.1.0.1 and NGINX Open Source to 1.30.6 or 1.31.7. The sources list no fixed version for NGINX Plus R33 to R36. Red Hat lists Red Hat Enterprise Linux 9 and 10 as affected without a fix and with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX Plus (F5) Fixed in 37.1.0.1, 37.0.5.1
  • Fix · CNA NGINX Open Source (F5) Fixed in 1.31.7, 1.30.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Open Source 1.30.6, 1.31.7

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-73990 Heap buffer overflow in NGINX alias and rewrite handlingPriority MEDIUM 44
    • TI-2026-74062 Use-after-free in NGINX ngx_http_core_module can crash workersPriority MEDIUM 43
    • TI-2026-74063 Forged SSL sessions in NGINX let attackers bypass client certificatesPriority LOW 36
    Show all 5 records →
  • Release ·

    F5 NGINX Plus 37.0.5.1, 37.1.0.1

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-73990 Heap buffer overflow in NGINX alias and rewrite handlingPriority MEDIUM 44
    • TI-2026-74062 Use-after-free in NGINX ngx_http_core_module can crash workersPriority MEDIUM 43
    • TI-2026-74063 Forged SSL sessions in NGINX let attackers bypass client certificatesPriority LOW 36
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-93479
  2. 2026-10-14 Alias added: GHSA-v72q-v4vf-2mx7
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → LOW
  5. 2026-10-16 Priority changed: LOW → MEDIUM
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-20 CVSS score added · Red Hat
  8. 2026-10-21 Affected versions changed · Red Hat
  9. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences