This vulnerability arises when the NGINX map directive uses regex matching and a string expression references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. Exploitation by an unauthenticated attacker sending crafted HTTP requests can cause a heap buffer overflow in the NGINX worker process, leading to a denial-of-service via process restart or potential code execution if ASLR is disabled or bypassed. The issue affects specific versions of NGINX Plus and is limited to the data plane without control plane exposure.

Remote attackers can cause denial-of-service by triggering a heap buffer overflow that restarts the NGINX worker process. Additionally, on systems with ASLR disabled or bypassed, attackers may achieve remote code execution. There is no impact on the control plane, limiting the scope to data plane operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is provided in the available data. Until a patch is available, consider restricting access to vulnerable NGINX Plus instances or applying configuration changes if recommended by the vendor.