Search: CVE-2026-27654

CVE-2026-27654 is a heap-based buffer overflow vulnerability in the ngx_http_dav_module of NGINX Open Source and NGINX Plus. It occurs when the configuration uses DAV module MOVE or COPY methods combined with prefix location and alias directives. Exploitation can cause termination of the NGINX worker process (denial of service) or modification of file names outside the document root. The impact on system integrity is limited due to the low privileges of the NGINX worker process user. A patch is available to address this vulnerability.