CVE-2026-60005

What it actually does

Uninitialized memory access in the NGINX worker process triggered when the ngx_http_slice_module is enabled alongside the slice directive with unnamed regex captures or during background cache updates, resulting in limited memory disclosure or worker process restart.

Why it matters to the business

Service restarts can cause brief outages for web and application traffic; limited memory exposure may leak small amounts of process data, though the module must be explicitly compiled in and specific configuration patterns must be present.

How an attack unfolds

An unauthenticated remote attacker identifies an NGINX instance with the slice module active and either unnamed regex captures in the slice directive or background cache updates enabled, then sends specially crafted HTTP requests that trigger the uninitialized memory access path, potentially disclosing limited memory contents or causing a worker restart.

How to fix it

Upgrade nginx-main (redhat) to version 1.30.4-2.hum1 or later as provided in RHSA-2026:46012; disable the slice module at compile time if unused; review and remove unnamed regex captures from slice directives.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the fixed release; audit nginx.conf and included files for slice directives containing unnamed captures; test affected endpoints with representative traffic after upgrade to verify absence of crashes or anomalous memory output.

Typical attack path

1. Scan for publicly reachable NGINX instances with slice module compiled in
2. Probe for configurations using slice directive with unnamed regex or background cache updates
3. Send crafted HTTP requests targeting the vulnerable code path
4. Observe responses for memory contents or worker process crashes and restarts

How to detect it

Review NGINX error and access logs for worker process crashes or segmentation faults around the time of unusual request patterns; correlate with any observed memory disclosure artifacts in responses; examine configuration history for slice directive usage.

What your security team should do

• Apply the vendor-supplied update to all affected instances within standard change windows given low EPSS and absence from KEV
• Inventory deployments to identify any using the slice module and prioritize those with regex or cache-update patterns
• Add configuration linting rules to CI/CD pipelines to block future use of unnamed captures with slice
• Monitor worker process restart rates and memory-related error logs as part of routine observability