CVE-2026-93479: CWE-122 Heap-based Buffer Overflow in F5 NGINX Plus

This vulnerability arises from improper handling of regex capture variables in map directives combined with usage patterns involving the root directive or access log format in NGINX Plus and NGINX Open Source. Specifically, referencing regex capture variables before the map output variable or using non-cacheable variables in string expressions can trigger a heap-based buffer overflow in the NGINX worker process. Exploitation requires sending specially crafted HTTP requests without authentication. The overflow can cause a denial-of-service via worker process restart and may allow remote code execution on systems with ASLR disabled or bypassed. The issue is confined to the data plane, with no control plane impact. The affected versions include multiple release series as explicitly stated.

Remote attackers can cause denial-of-service by triggering a heap buffer overflow that restarts the NGINX worker process. Additionally, on systems where ASLR is disabled or can be bypassed, attackers may achieve remote code execution. There is no exposure of the control plane, limiting the impact to data plane operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information are provided, users should monitor F5's official advisories for updates. Until a fix is available, avoid configurations that use regex capture variables in map directives combined with root or access log format referencing those variables before the map output variable, or using non-cacheable variables in string expressions under the described conditions.