Executive brief
NGINX Plus and NGINX Open Source, widely used web servers and reverse proxies, contain a vulnerability in their URL rewriting module. An unauthenticated attacker can send specially crafted web requests to crash the server process, causing a service outage. In specific configurations where certain security protections like ASLR are disabled or bypassed, this could also allow an attacker to take control of the server.
Technical details
A heap-based buffer overflow exists in the ngx_http_rewrite_module of NGINX. The flaw is triggered when a rewrite directive uses a regular expression with overlapping PCRE captures (e.g., ^/((.*))$) and a replacement string that references multiple such captures (e.g., $1$2) within a redirect or arguments context. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests, leading to a worker process crash (DoS). If Address Space Layout Randomization (ASLR) is disabled or bypassed, arbitrary code execution may be possible. The issue is fixed in NGINX Open Source versions 1.31.1 and 1.30.2, and NGINX Plus version 37.0.1.1.
Affected products
- F5 NGINX Plus r32-r36, 37.0.0-37.0.1.0
- F5 NGINX Open Source 0.1.17-0.9.7, 1.0.0-1.30.1, 1.31.0
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory
- 2026-05-22: patched: Fixed in NGINX 1.31.1 and 1.30.2