Heap Buffer Overflow in NGINX Plus and NGINX Open Source
CVE-2026-93479

9.2CRITICAL

Key Information:

Vendor

F5
Status
Nginx Plus
Nginx Open Source
Vendor
CVE Published:
14 October 2026

What is CVE-2026-93479?

A vulnerability in NGINX Plus and NGINX Open Source arises when the map directive utilizes regex matching, leading to a potential heap buffer overflow. This occurs if the root directive or access log format refers to the map's regex capture variables prior to referencing the map output variable. Additionally, a non-cacheable variable in a string expression can produce the same outcome under certain conditions. Unauthenticated attackers may exploit this issue by sending specially crafted HTTP requests, which can result in a denial-of-service (DoS) condition or possibly allow code execution on systems with Address Space Layout Randomization (ASLR) disabled or where ASLR can be bypassed.

Affected Version(s)

NGINX Open Source 1.31.2 < 1.31.7

NGINX Open Source 1.30.0 < 1.30.6

NGINX Plus 37.1.0 < 37.1.0.1

References

https://my.f5.com/manage/s/article/K000162607
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges "Matt Suiche" of "Tolmo, Inc." and "Mateusz Gierblinski " for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.