Executive brief
NGINX Plus and NGINX Open Source are widely used web server and reverse proxy solutions. A vulnerability in an optional module could allow an unauthenticated attacker to trigger a crash of the server process or potentially view small portions of system memory. This could lead to service interruptions or the exposure of sensitive technical data, though it does not grant full control over the server.
Technical details
A vulnerability exists in the NGINX ngx_http_slice_module (CWE-908) when the 'slice' directive is used alongside unnamed regex captures or during background cache updates. An unauthenticated remote attacker can send specially crafted requests that trigger uninitialized memory access in the NGINX worker process. This can result in a denial-of-service (DoS) via worker process restart or limited information disclosure of memory contents. The vulnerability is only present if NGINX is compiled with the --with-http_slice_module parameter, as it is not enabled by default. Patches are available in updated versions of NGINX Plus and Open Source.
Affected products
- F5 NGINX Plus 37.0.0.1 to 37.0.3.1, R36 before P7, R33 and later
- F5 NGINX Open Source 1.15.8 to 1.30.4, 1.31.2 to 1.31.3
Timeline
- 2026-07-15: advisory: Initial publication of the advisory