CVE-2026-9256
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source occurs when a rewrite directive uses a regex pattern with overlapping PCRE captures and a replacement string referencing multiple captures. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.
Risk Assessment
An attacker can cause NGINX worker process crashes (restart) and potentially execute code on systems with ASLR disabled or bypassed.
Recommendation
Update NGINX to a patched version and avoid using regex patterns with overlapping captures in rewrite directives.
Other vulnerabilities in NGINX
See all- CVE-2026-90439Medium
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.
- CVE-2016-1247High
The nginx package before 1.6.2-5+deb8u3 on Debian jessie and earlier versions on Ubuntu and Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- CVE-2016-4450High
In nginx before 1.10.1 and 1.11.x before 1.11.1, a vulnerability allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
- CVE-2016-0742High
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service via an invalid pointer dereference, leading to a worker process crash.
- CVE-2014-0133High
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.
- CVE-2026-42055High
Heap-based buffer overflow in NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module. Specific configuration conditions and large headers can cause NGINX worker process crash, and in some cases allow code execution.
- CVE-2026-42945High
A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_rewrite_module. It occurs when the rewrite directive is followed by rewrite, if, or set directives and an unnamed PCRE capture (e.g., $1, $2) with a replacement string containing a question mark (?). An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.
- CVE-2026-27654High
A vulnerability in the NGINX ngx_http_dav_module allows an attacker to trigger a buffer overflow in the NGINX worker process. The issue occurs when the configuration uses MOVE or COPY methods with alias directives and prefix locations.
- CVE-2016-0746Critical
A use-after-free vulnerability in the resolver in nginx versions 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
- CVE-2026-60005High
A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_slice_module module. When the slice directive with unnamed regex captures is configured or during a background cache update, unauthenticated attackers can send requests causing uninitialized memory access in the NGINX worker process, leading to limited memory disclosure or a restart.
Original NVD description (English source)
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.