The vulnerability arises when the NGINX map directive uses regex matching and a string expression references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. This can lead to a heap-based buffer overflow in the NGINX worker process. Exploitation requires sending crafted HTTP requests without authentication. The impact includes denial-of-service via process restart and potential code execution on systems without effective ASLR. The vulnerability affects certain versions of NGINX Plus (37.0.0.1, R36, R33). No official remediation or patch information is provided yet.

Remote attackers can cause denial-of-service by triggering a heap buffer overflow that restarts the NGINX worker process. Additionally, on systems where ASLR is disabled or bypassed, attackers may achieve remote code execution. The vulnerability affects only the data plane, with no exposure to the control plane.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published. Until a patch is available, consider restricting access to vulnerable NGINX instances or applying any vendor-recommended workarounds once available.