CVE-2026-60005

Awaiting Analysis Awaiting Analysis - Queue

Uninitialized Memory Access in NGINX Plus and Open Source

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: F5 Networks

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-60005

EUVD

EUVD-2026-44697

Affected Vendors & Products

Vendor	Product	Version / Range
nginx	nginx_plus	*
nginx	nginx_open_source	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability affects NGINX Plus and NGINX Open Source when the slice directive and unnamed regex captures are configured or during a background cache update. It allows unauthenticated attackers to send requests that cause uninitialized memory access in the NGINX worker process, potentially leading to limited memory disclosure or a worker process restart.

Detection Guidance

Detecting this vulnerability requires checking if the ngx_http_slice_module is enabled in your NGINX configuration. Use the command 'nginx -V 2>&1 | grep -o with-http_slice_module' to verify if the module is compiled. If it returns 'with-http_slice_module', the module is active. Additionally, inspect your NGINX configuration files for the 'slice' directive or unnamed regex captures.

Impact Analysis

This vulnerability allows remote attackers to potentially access sensitive memory contents or cause NGINX worker processes to restart unexpectedly. This could disrupt services relying on NGINX, though it does not provide full control over the system.

Compliance Impact

This vulnerability may lead to limited disclosure of memory contents, which could potentially expose sensitive data. This could impact compliance with GDPR (data protection) and HIPAA (health information privacy) if such data is involved. However, the vulnerability does not provide direct control over data or systems, limiting its immediate regulatory impact.

Mitigation Strategies

If the ngx_http_slice_module is enabled, disable it by recompiling NGINX without the --with-http_slice_module flag. Remove any 'slice' directives or unnamed regex captures from your configuration files. Restart NGINX to apply changes. Ensure you are running a patched version of NGINX once available.

Hi! I’m here to help you understand CVE-2026-60005. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70