CVE-2026-27654 is a heap-based buffer overflow vulnerability in the ngx_http_dav_module of NGINX Open Source and NGINX Plus. It occurs when the configuration uses DAV module MOVE or COPY methods combined with prefix location (non-regular expression) and alias directives. Successful exploitation can lead to termination of the NGINX worker process (Denial of Service) or modification of source or destination file names outside the intended document root. The impact on integrity is limited due to the low privileges of the NGINX worker process user. Red Hat has published advisories confirming the vulnerability and providing patches in updated nginx packages.

The vulnerability can cause a denial of service by crashing the NGINX worker process or potentially allow modification of file names outside the document root, impacting integrity. The NGINX worker process runs with low privileges, limiting the scope of impact. There is no confidentiality impact reported. The CVSS v3.1 score is 8.2 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

A patch is available and should be applied to affected NGINX installations. Red Hat has released updated nginx packages addressing this vulnerability. Users should upgrade to the fixed versions as per vendor advisories. No effective mitigations other than patching are currently recommended by Red Hat. Check vendor advisories for detailed update instructions and apply updates promptly.