Advisory · CVE-2026-93479
Heap overflow in NGINX map regex handling can crash workers or run code
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable: crafted HTTP requests can cause a heap buffer overflow in the worker process, restarting it, and possibly code execution where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
- Vendor
- F5
- Product
- NGINX Plus and NGINX Open Source
- Identifier / CWE
- CVE-2026-93479
CWE-122 - Action timing
- Immediate
Explain it like I’m five
The order variables are mentioned in a config decides whether a request overflows the worker. Configuration trivia, memory corruption outcome.
- 01Crafted request arrives
An attacker sends HTTP requests shaped to reach the affected NGINX configuration path.
- 02Worker memory corrupted or check bypassed
The flaw takes effect in the NGINX worker or ingress data plane.
- 03Impact lands
The attacker gains the access, crash, or code execution the flaw allows.
What happened
F5 disclosed CVE-2026-93479 for NGINX Plus and NGINX Open Source. The trigger configuration is a map directive with regex matching where the root directive or an access log format references the map’s regex capture variables before the map output variable; a non-cacheable variable in a string expression can produce the same result under certain conditions. Crafted HTTP requests can overflow the worker heap, causing a restart and possibly code execution where ASLR is disabled or bypassed. F5 lists NGINX Open Source 1.31.2 before 1.31.7 and 1.30.0 before 1.30.6, plus NGINX Plus 37.x and R33 through R36 lines, as affected.
F5’s K000162607 lists the affected versions and the fixed builds. Match your deployment to the article before changing anything.
What to do
- Inventory every NGINX Plus and NGINX Open Source deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to NGINX Plus and NGINX Open Source while remediation is underway, especially for internet-facing instances.
- Review application and server logs for NGINX worker restarts on sites using map with regex captures, and requests exercising those map variables.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Second NGINX heap overflow this cycle, different config trigger. Patch once for the set, then inventory map usage to understand exposure.