CVE-2026-93479

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in NGINX Plus and NGINX Open Source

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93479

EUVD

EUVD-2026-101114

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Plus 37.1.0
F5	NGINX	Plus 37.0.0
F5	NGINX	Plus R36
F5	NGINX	Plus R35
F5	NGINX	Plus R34
F5	NGINX	Plus R33
F5	NGINX	Open Source 1.31.2
F5	NGINX	Open Source 1.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, it could occur by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker can exploit this by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart. Code execution is possible if ASLR is disabled or bypassed.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable NGINX configurations. Inspect NGINX configuration files for map directives using regex matching where root directives or access log formats reference regex capture variables before the map output variable. No specific commands are provided, but manual review of configuration files is necessary.

Impact Analysis

This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or possibly trigger code execution. It only affects the data plane, not the control plane, meaning it impacts web traffic handling but not administrative functions.

Compliance Impact

This vulnerability primarily causes denial-of-service or potential code execution on NGINX systems. It does not directly impact data confidentiality or integrity but may disrupt service availability. Compliance with GDPR or HIPAA depends on whether the NGINX system processes regulated data; a DoS could affect availability requirements.

Mitigation Strategies

Upgrade NGINX Plus or NGINX Open Source to a patched version that addresses this vulnerability. If using NGINX Plus, check with F5 for available updates. For NGINX Open Source, apply the latest stable release. Avoid using regex matching in map directives or ensure map output variables are referenced before regex capture variables in root or access log format directives.

Hi! I’m here to help you understand CVE-2026-93479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70