Vulnpedia
← Search CVEs

CVE-2026-93479

CRITICAL 9.2

Published 2026-10-14 · Last modified 2026-10-23

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact:  This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

ELEVATED IMPACT

Severe if exploited (CVSS 9.2), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

1.0%chance of exploitation in 30 days · 63rd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.2CVSS 4.0 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors F5

Products Nginx Plus Nginx Open Source

Weakness (CWE)

  • CWE-122: Heap-based Buffer Overflow

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 55 vendor product statements; 23 omitted. Read the full vendor advisory.

  • nginx as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-all-modules as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-all-modules

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-filesystem as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-filesystem

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-devel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-devel

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-perl as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-http-perl

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-xslt-filter as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-http-xslt-filter

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-mail as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-mail

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx?arch=src

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-core

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-filesystem as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-filesystem

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-devel as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-devel

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-perl as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-http-perl

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-xslt-filter as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-http-xslt-filter

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-stream as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx-mod-stream

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nginx?arch=src

    • workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. According to F5, the following versions contain the fix: 1.31.7, 1.30.6
    • none available: Fix deferred
    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-all-modules (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-all-modules?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-devel (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-devel?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-perl (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-http-perl?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-mail (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-mail?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-all-modules (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-all-modules?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-core (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-core?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-filesystem (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-filesystem?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-devel (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-devel?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-image-filter (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-http-image-filter?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-perl (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-http-perl?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-http-xslt-filter (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-http-xslt-filter?rpmmod=nginx:1.26

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx-mod-stream (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx-mod-stream?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx.src (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx?arch=src&rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx?rpmmod=nginx:1.24

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00
  • nginx.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nginx?arch=src

    Red Hat · CVE-2026-93479 · Updated 2026-10-21T09:23:26+00:00

All CVSS metrics

  • HIGH 8.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.2 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CRITICAL 9.2 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 8.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS