Multiple heap buffer overflow and use-after-free vulnerabilities exist in NGINX Plus and NGINX Open Source related to specific configurations involving the alias directive with rewrite and set/return referencing $request_filename, map directives with regex capture variables, and asynchronous file I/O with Server Side Includes. These vulnerabilities can be exploited by unauthenticated attackers sending crafted HTTP requests, potentially causing denial-of-service (DoS) conditions or remote code execution on systems with ASLR disabled or bypassed. There is no control plane exposure; the issues affect only the data plane. Fixed versions are available.