Executive brief
NGINX, a widely used web server and reverse proxy, contains a critical vulnerability in its URL rewriting module. An unauthenticated attacker can send specially crafted web requests to trigger a memory error, potentially allowing them to crash the service or take full control of the server. This issue affects systems using specific configuration patterns involving URL rewrites and regular expressions.
Technical details
A heap-based buffer overflow exists in src/http/ngx_http_script.c within the ngx_http_rewrite_module. The vulnerability is triggered when a 'rewrite' directive uses an unnamed PCRE capture (e.g., $1, $2) and a replacement string containing a question mark, followed by another rewrite, if, or set directive. The root cause is a mismatch in how NGINX calculates the destination buffer size versus how it performs the actual copy; the script engine fails to clear the 'is_args' flag, leading to URI re-escaping that expands the data beyond the allocated buffer. An unauthenticated remote attacker can exploit this via crafted HTTP requests to cause a worker process crash or achieve remote code execution, particularly if ASLR is disabled or bypassed. Patches are available in NGINX Open Source 1.31.0 and 1.30.1, and NGINX Plus R36 P4 and R32 P6.
Affected products
- NGINX NGINX Open Source 0.6.27 through 1.30.0
- NGINX NGINX Plus R32 through R36
- NGINX NGINX Instance Manager 2.16.0 through 2.21.1
- NGINX NGINX App Protect WAF 4.9.0 through 4.16.0, 5.1.0 through 5.8.0
- NGINX NGINX Gateway Fabric 1.3.0 through 1.6.2, 2.0.0 through 2.5.1
- NGINX NGINX Ingress Controller 3.5.0 through 3.7.2, 4.0.0 through 4.0.1, 5.0.0 through 5.4.1
Timeline
- 2026-05-13: disclosed: Coordinated disclosure by F5 and depthfirst
- 2026-05-13: advisory: F5 published security advisory K000161019
- 2026-05-13: patched: Fixed versions released for NGINX Open Source and Plus