CVE-2026-9256

What it is

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.

Exploit odds

10.9% chance of exploitation in the next 30 days (EPSS). Higher than most.

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-22 15:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-25 13:19 UTC Last updatedMost recent change to the record

Details

Published

2026-05-22 15:16 UTC

Last modified

2026-08-25 13:19 UTC

Exploit probability

10.9% · EPSS, next 30 days

Weakness

CWE-122

Record status

Modified

Affected

• f5 nginx Open Source ≤ 0.9.7
• f5 nginx Open Source < 1.30.2
• f5 nginx Open Source 1.31.0
• f5 nginx Plus < r36
• f5 nginx Plus 37.0.0.1
• f5 nginx Plus r32
• f5 nginx Plus r36
• f5 Dos ≤ 4.7.0

Attack profile CVSS 4.0 · 9.2

Attack vector

Network

Complexity

High

Attack requirements

Present

Privileges needed

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High