NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
| Vendor | Product | Versions |
|---|---|---|
| f5 | nginx_open_source | 37.0, R36, R32, 1.31.0, 1.30.0, 0.1.17 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| f5 | nginx_plus | cve_cpe | 95% |
| nginx | nginx plus | cert_advisory | 90% |
| nginx | nginx | cert_advisory | 90% |
| oracle | oracle communications | cert_advisory | 90% |
Updated affected versions to include 1.30.1 and 37.0.1.1, and added new tag CVE-2026-9256.
Updated affected versions to include 1.30.2, 37.0.11, R36 P5, R32 P7 and provided a more detailed description of the vulnerability's impact.
Updated description to include Denial of Service potential and changed severity to CRITICAL.
Updated vendor to cPanel, product to ea-nginx, added affected version v1.31.1, and included CVE-2026-9256.
Added new affected versions for various NGINX products and included relevant tags.
Updated vendor to F5, product to NGINX Open Source, changed severity to CRITICAL, and noted that there is no exploit available.
Initial creation
