CVE-2026-60005

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server.

Security Fix(es):

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42533)

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.

Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-56434)

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-60005)

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)

• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)

• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)

• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)

• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)

• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
• nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• SECURITY UPDATE: heap buffer overflow in nginx worker via map+regex capture variables in script engine
  • debian/patches/CVE-2026-42533.patch: backport upstream commits ea47fabf55e2 (Script: simplified copy capture codes), 7ac67898bdfe (Script: buffer overrun protection), 326b17b00383 (Script: buffer overrun protection in direct script usage), 78950bdcd443 (Access log: buffer overrun protection), b99f804ad38a (Fixed uninitialized memory read caused by stale regex captures), and 97e40e59b7b4 (Script: avoid garbage at the end of the result string); add e->end pointer and ngx_http_script_check_length() guard to all script copy code paths, reset r->ncaptures on regex reallocation, and thread params_len / headers_len through fastcgi, grpc, scgi, uwsgi upstream request builders so an attacker-controlled map+regex expansion can no longer overrun the assembled request or access log buffer
  • CVE-2026-42533

• CVE-2026-56434: fix use-after-free from duplicate subrequest finalization; ngx_http_post_request() now skips a request that is already posted, and ngx_http_finalize_request() resets r->write_event_handler to a no-op handler during active subrequest finalization
• CVE-2026-60005: fix uninitialized memory read via stale regex captures in slice/background-update subrequests; ngx_http_regex_exec() now resets r->ncaptures when reallocating the captures array after a failed match

CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression. Thanks to Mufeed VH of Winfunc Research and Maxim Dounin. . CVE-2026-60005: Uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination. . CVE-2026-56434: Use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module. Thanks to P4P3R-HAK.

These are all security issues fixed in the nginx-1.31.3-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-60005 in the nginx package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2026-60005 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2026-60005 in the nginx package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-60005 in the nginx package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-60005 in the nginx package for Root:Debian:13. Multiple fixed versions available.