CVE-2026-93479 in NGINX Plus
Summary
by MITRE • 10/15/2026
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in NGINX Plus and NGINX Open Source represents a critical memory safety flaw rooted in the internal variable handling mechanisms during request processing. Specifically, the issue arises when the configuration utilizes a map directive with regex matching capabilities where the root directive or access log format attempts to reference capture variables from that regular expression before the corresponding output variable of the map is fully resolved. This specific ordering creates a race condition within the worker process logic, leading to an invalid memory state. Alternatively, this same vulnerability can be triggered by using non-cacheable variables in string expressions under certain configuration conditions. The core technical flaw involves improper bounds checking and initialization sequences when NGINX attempts to resolve these dynamic values during the parsing of HTTP requests. This results in a heap buffer overflow within the worker process memory space, which is the primary mechanism through which an attacker can disrupt service integrity or potentially gain higher privileges on the host system.
From an operational perspective, this vulnerability allows unauthenticated attackers to exploit the flaw by sending specially crafted HTTP requests that trigger the malformed variable resolution sequence. Because NGINX operates as a high-performance web server and reverse proxy handling thousands of concurrent connections, the ability to cause a heap buffer overflow in its worker processes poses significant risks. The immediate impact is often a denial-of-service condition resulting from the forced restart or crash of the affected worker process. However, given that this involves memory corruption on the heap, it also opens the door for remote code execution if specific system conditions are met. Specifically, attackers can leverage this overflow to execute arbitrary code on systems where Address Space Layout Randomization is disabled or when they possess additional capabilities allowing them to bypass ASLR protections. This transforms what might otherwise be a simple service disruption into a severe security breach with potential full system compromise implications.
This incident aligns closely with CWE-120, which describes Buffer Copy without Checking Size of Input Classic Buffer Overflow, as the root cause is an improper handling of input data leading to memory corruption. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Execution techniques due to its potential for remote code execution via crafted network traffic. It is important to note that this is strictly a data plane issue with no control plane exposure, meaning it affects the handling of incoming client requests rather than administrative configuration interfaces. Organizations running NGINX must prioritize patching to versions where this variable resolution logic has been corrected to prevent both denial-of-service attacks and potential code execution exploits. Regular updates are essential as software versions that have reached End of Technical Support are no longer evaluated for such vulnerabilities, leaving them exposed to known exploitation techniques without vendor-provided fixes or security advisories.