CVE-2026-93479 – Heap Buffer Overflow (DoS / Potential RCE) – NGINX Open Source 1.30.0–1.30.5 and 1.

Summary

CVE-2026-93479 is a heap-based buffer overflow (CWE-122) in NGINX Plus and NGINX Open Source. An unauthenticated remote attacker can send crafted HTTP requests to cause a denial of service. Code execution is possible on systems without ASLR. The CVSS v3.1 base score is 8.1 (High).

Technical details

• Root cause: Heap buffer overflow when a map directive uses regex matching and the root directive or the access log format references the map’s regex capture variables before it references the map output variable.
• Trigger conditions: The affected configuration must be present. The advisory also states that conditions outside the attacker’s control are required.
• Attack vector: Network. The attacker is unauthenticated and sends crafted HTTP requests, and no user interaction is needed.
• Impact: Worker process crash (denial of service). Code execution is possible on systems without ASLR protection.

Affected software

• NGINX Open Source: 1.30.0 through 1.30.5
• NGINX Open Source: 1.31.2 through 1.31.6
• NGINX Plus: 37.1.0 through 37.1.0.0
• NGINX Plus: 37.0.0 through 37.0.5.0
• NGINX Plus: R33, R34, R35 and R36 (all releases)

Severity

• CVSS v3.1 base score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• The CNA also lists a CVSS v4.0 score of 9.2.

Mitigation and recommended actions

• Immediate: Upgrade to NGINX Open Source 1.30.6 or 1.31.7 or later. For NGINX Plus, upgrade to 37.1.0.1 or 37.0.5.1 or later.
• Workaround: Replace unnamed regex captures with named captures, and restrict their scope to the regex match block.
• Review configurations for regex map capture variables used in root or log_format before the map output variable.

References

• CVE-2026-93479 at NIST
• F5 Advisory K000162607