CVE-2026-93479
NGINX map regex capture heap buffer overflow in worker process
F5 fixed a heap buffer overflow when evaluating string expressions with variables in NGINX Plus and NGINX Open Source. F5 scores it CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates it medium. An unauthenticated attacker can crash a worker, or run code if ASLR is off or bypassed. Specific configuration required. Fixed in OSS 1.31.7 and 1.30.6 and Plus 37.1.0.1 and 37.0.5.1. Not in CISA KEV.
- CVSS
- 9.2
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Class
- RCE
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- F5
- Products
- NGINX Plus, NGINX Open Source
- Affected
- NGINX Plus 37.1.0 before 37.1.0.1, 37.0.0 before 37.0.5.1, and R33 to R36. NGINX Open Source 1.31.2 before 1.31.7 and 1.30.0 before 1.30.6. Only specific configurations are exposed.
- Fixed
- NGINX Open Source 1.31.7 (mainline) and 1.30.6 (stable), and NGINX Plus 37.1.0.1 and 37.0.5.1, released 14 October 2026. F5 lists no fix for Plus R33 to R36.
- CWE
- CWE-122
- Published
- 14 Oct 2026
- Updated
- 14 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-93479 is a heap buffer overflow when evaluating string expressions with variables in NGINX Plus and NGINX Open Source. F5 published its advisory on 14 October 2026. The weakness is CWE-122.
It needs a map directive with regex matching whose capture variables are used by root or an access log format before the map output. A non-cacheable variable in a string expression can also trigger it under certain conditions. Default configurations are not described as affected.
F5 scores it CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates the same issue medium. NVD shows the F5 scores and is awaiting analysis.
An unauthenticated attacker can send crafted HTTP requests and crash the worker process. F5 says code execution is possible when ASLR is disabled or can be bypassed. F5 says this is a data plane issue with no control plane exposure.
Fixed versions are NGINX Open Source 1.31.7 and 1.30.6, and NGINX Plus 37.1.0.1 and 37.0.5.1. F5 lists Plus R33 to R36 as affected with no fix. F5 credits Matt Suiche of Tolmo, Inc. and Mateusz Gierblinski.
The CVE is not in the CISA KEV catalog. ThreatWire found no report of exploitation and no public PoC.