NGINX Plus: Heap-based Buffer Overflow

What to do

1. Update NGINX Plus to R36 P4 or R32 P6, whichever matches your release line, or a later version.
2. Update NGINX Open Source to 1.30.1 or a later version.
3. Read the advisory on my.f5.com for workarounds and exact fixed builds.
4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 4 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

HighSuccess depends on conditions outside the attacker's control.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (f5.com).

Official description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Heap-based Buffer Overflow

Timeline

1. May 13, 2026CVE record published.
2. May 13, 2026CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
3. October 26, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in NGINX Plus

• 8.1 High severity

  NGINX Plus: Use After Free

  CVE-2026-97205Oct 14, 2026F5
• 8.1 High severity

  NGINX Plus: Heap-based Buffer Overflow

  CVE-2026-93479Oct 14, 2026F5EPSS 1.2%
• 8.1 High severity

  NGINX Plus: Heap-based Buffer Overflow

  CVE-2026-15176Oct 14, 2026F5
• 8.2 High severity

  NGINX Plus: Use of Uninitialized Resource

  CVE-2026-60005Jul 15, 2026F5
• 8.1 High severity

  NGINX Plus: Heap-based Buffer Overflow

  CVE-2026-42533Jul 15, 2026F5EPSS 6.3%
• 8.1 High severity

  NGINX Open Source: Out-of-bounds Write

  CVE-2026-42055Jun 17, 2026F5EPSS 6.54%

Recent Heap-based Buffer Overflow vulnerabilities

• 9.8 Critical severity

  Cloud NGFW: Heap-based Buffer Overflow

  CVE-2026-0264May 13, 2026Palo Alto Networks
• 8.8 High severity

  ESXi 8.x and ESXi 9.x hosts using AMD-Pensando…: Heap-based Buffer Overflow

  CVE-2025-62624May 13, 2026AMD
• 7.5 High severity

  HPE Aruba Networking Wireless Operating System…: Heap-based Buffer Overflow

  CVE-2026-23827May 12, 2026Hewlett Packard Enterprise
• 7.8 High severity

  Illustrator Desktop 2026: Heap-based Buffer Overflow

  CVE-2026-34687May 12, 2026Adobe
• 7.8 High severity

  After Effects: Heap-based Buffer Overflow

  CVE-2026-34642May 12, 2026Adobe
• 7.8 High severity

  Simcenter Femap: Heap-based Buffer Overflow

  CVE-2025-12659May 12, 2026Siemens

Spotted an error? Tell us.