Loading vulnerability…
Heap Buffer Overflow in NGINX Variable Expression Evaluation
CVE-2026-93479 is a heap-based buffer overflow in NGINX Plus and NGINX Open Source variable expression evaluation. A susceptible configuration uses regular-expression matching in a map directive and references the map's regex capture variables in a root directive or access-log format before referencing the map output variable. Certain string expressions containing non-cacheable variables can also trigger the flaw. String expression evaluation in HTTP and stream modules can overwrite reserved buffer space, including during evaluation of variable document roots and access-log paths. The vulnerability is a regression introduced by the fix for CVE-2026-42533. Crafted HTTP requests can cause worker-process crashes and potentially arbitrary code execution. Exposure is limited to the data plane; the control plane is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote exploitation can corrupt heap memory and crash or restart NGINX worker processes, causing denial of service. Repeated triggering can sustain service disruption despite automatic worker restarts. Arbitrary code execution is possible if Address Space Layout Randomization (ASLR) is disabled or bypassed, potentially compromising confidentiality and integrity within the worker process's security context. Enabled ASLR reduces code-execution risk but does not eliminate the overflow or denial-of-service risk.
If you can’t patch tonight, do this now.
Replace unnamed regular-expression captures with named captures and reference them only within the block containing the regex match. Keep ASLR enabled as defense in depth; it does not prevent worker crashes and may be bypassed. Run workers without elevated privileges and segment internet-facing deployments to limit the consequences of possible code execution. Monitor repeated worker crashes or restarts for potential exploitation attempts.
Patch, then assume compromise.
Upgrade NGINX Open Source to stable version 1.30.6, mainline version 1.31.7, or a later fixed release in the applicable branch. For NGINX Plus and products embedding NGINX, install the product-specific fixed release identified by F5; migrate to a fixed branch if the current branch has no fix. Distribution packages may contain security backports and must be assessed using distribution advisories rather than upstream version numbers alone. Debian 13 is fixed in 1.26.3-3+deb13u10. Ubuntu fixes are 1.18.0-6ubuntu14.22 for 22.04 LTS, 1.24.0-2ubuntu7.19 for 24.04 LTS, 1.28.3-2ubuntu1.12 for 26.04 LTS, and 1.30.4-7ubuntu1.1 for 26.10. End-of-Technical-Support releases were not evaluated and should not be assumed unaffected.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.