External risk intelligence

NGINX Heap Buffer Overflow via Crafted HTTP Requests

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-93479

NGINX is a foundational internet-facing component, commonly deployed as an edge gateway, load balancer, or public-facing reverse proxy. Because the vulnerability is triggered via crafted HTTP requests directed at the data plane and does not require authentication, it directly affects the primary public-facing surface for which this software is designed.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in NGINX Plus and NGINX Open Source, related to how it handles certain configurations with regex matching, could allow unauthenticated attackers to cause a denial-of-service or potentially execute code. This issue affects the data plane and can lead to a restart of the NGINX worker process.

NGINX configuration flaw can cause service disruption.
Affects internet-facing web traffic handling.
Focus on confirming relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to an exposed NGINX instance. The attacker's journey begins with network access to the NGINX server, which then processes these requests through its map directive. If the configuration meets specific conditions related to regex matching and variable referencing, the NGINX worker process can be targeted, potentially leading to a heap buffer overflow, system restart, and in some cases, code execution if ASLR is bypassed.

Unauthenticated network access required.
Triggered by crafted HTTP requests.
Risk of denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests to NGINX systems with specific configurations involving map directives and regex matching. When successful, this could lead to a heap buffer overflow in the NGINX worker process, potentially causing a denial-of-service by restarting the worker. In environments where Address Space Layout Randomization (ASLR) is disabled or bypassed, this could further escalate to remote code execution.

NGINX worker processes and system availability.
Crafted HTTP requests triggering heap overflow.
Denial-of-service or potential code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects NGINX Plus and NGINX Open Source, impacting web servers, load balancers, and reverse proxies. Identifying these instances, determining their exposure and criticality, and locating the responsible system owners are the initial steps. Remediation planning should follow based on the assessed risk.

Identify NGINX instances and exposure.
Confirm business criticality and ownership.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NGINX Plus and NGINX Open Source?

These are widely used software solutions that function as web servers, load balancers, and reverse proxies. They act as traffic controllers for applications, sitting between the internet and backend servers to manage incoming requests efficiently. Because they handle public web traffic and routing, they are foundational components in many network architectures.

What does CVE-2026-93479 mean for system memory?

This vulnerability involves a heap buffer overflow, classified as CWE-122. It happens when the software improperly manages memory while processing complex configurations—specifically when regex matching variables are accessed in a specific order. This error can crash the worker process or, in certain security-weakened environments, allow unauthorized code to execute.

How do attackers trigger this NGINX vulnerability?

An attacker triggers this by sending specially crafted HTTP requests to the server. Importantly, the bug is not triggered by standard traffic; it requires specific, uncommon server configuration patterns involving map directives. If your NGINX instance does not use regex matching within map directives in the specific way described, it is not affected by this trigger path.

Why is this CVE considered relevant for my infrastructure?

Halo Surface Signal highlights that this vulnerability is highly relevant because it targets the data plane of internet-facing gateways. Since NGINX is frequently deployed as a public-facing reverse proxy to handle incoming web traffic, an unauthenticated remote attacker could potentially reach this vulnerable code path without needing any valid user credentials.

How should I respond to this NGINX threat?

Begin by auditing your NGINX configurations to see if you are using map directives with regex matching and specific variable references. Once you identify instances using these patterns, prioritize them by business criticality and confirm who manages those specific systems. This assessment will help you plan the necessary updates or configuration changes to mitigate the risk of a crash or unauthorized access.

References

my.f5.com/manage/s/article/K000162607

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.