CVE-2026-9256

What it actually does

This vulnerability is a heap buffer overflow in NGINX Plus and NGINX Open Source when the ngx_http_rewrite_module processes a specific class of rewrite rules. The risky condition is a rewrite directive that uses distinct but overlapping PCRE capture groups, such as nested captures, and then references more than one of those captures in a redirect or query-arguments replacement string. A crafted unauthenticated HTTP request can trigger incorrect buffer handling in an NGINX worker process. The most likely technical outcome is worker-process crash and restart, causing denial of service or intermittent request failures. Under more favorable attacker conditions, especially where ASLR is disabled or bypassed, the overflow may be usable for code execution in the context of the NGINX worker process.

Why it matters to the business

Internet-facing NGINX deployments using vulnerable rewrite configurations may be exposed to unauthenticated remote attacks that can interrupt web traffic, degrade availability, or potentially allow compromise of the web proxy/application delivery tier. Because NGINX often sits at the edge in front of many applications, even a worker crash loop can affect multiple business services. The CVSS score is high and EPSS is approximately 10%, indicating meaningful exploitation interest, although it is not currently listed in CISA KEV and no mature public exploit is indicated. Organizations with NGINX instances that use complex rewrite rules should prioritize review and remediation because exploitability depends heavily on configuration.

How an attack unfolds

An attacker first identifies an NGINX endpoint that processes requests through ngx_http_rewrite_module. The vulnerability is only reachable when the server configuration contains a rewrite directive with overlapping PCRE capture groups and a replacement expression that reuses multiple overlapping captures in a redirect or arguments context. The attacker then sends crafted HTTP requests whose path or arguments are shaped to exercise those captures. During rewrite processing, NGINX miscalculates or mishandles heap buffer contents, resulting in memory corruption in the worker process. In the common case, the worker terminates and the master process starts a replacement worker, producing availability impact and error-log artifacts. In a more severe scenario, if memory-layout protections such as ASLR are disabled or bypassed, the attacker may be able to shape the overflow to gain code execution with the privileges of the NGINX worker process.

How to fix it

Upgrade NGINX Plus or NGINX Open Source to a vendor-fixed release as soon as fixed versions are available for the deployed branch. No exact fixed versions were provided in the input, so administrators should consult F5/NGINX security advisories and package repositories for the corrected builds. As an immediate mitigation, audit NGINX configurations for rewrite directives that combine overlapping or nested PCRE capture groups with replacement strings that reference multiple captures, especially in redirect or arguments contexts. Rewrite those rules to avoid overlapping captures, remove unnecessary nested groups, use non-capturing groups where possible, or split complex rewrites into safer, simpler rules. Ensure ASLR is enabled at the operating-system level and avoid running NGINX with unnecessary privileges. If end-of-technical-support versions are in use, migrate to a supported version because unsupported releases may not receive evaluation or fixes.

How to confirm the fix worked

Confirm remediation by verifying the installed NGINX package version against the vendor advisory for this vulnerability and confirming that the running binary is the patched build. Review active NGINX configuration, including included files, for rewrite directives with nested or overlapping captures such as patterns similar to ^/((.*))$ and replacements that concatenate or otherwise reference multiple captures such as $1$2. Run nginx -t after configuration changes and reload NGINX only after validation succeeds. Confirm ASLR is enabled on Linux systems by checking that /proc/sys/kernel/randomize_va_space is set to 2. After remediation, monitor error logs during normal traffic and controlled testing to ensure worker processes no longer crash when rewrite paths are exercised.

Typical attack path

1. Locate an internet-accessible NGINX Plus or NGINX Open Source service.
2. Probe URL paths and redirect behavior to infer use of rewrite rules and regex-based redirects or argument rewrites.
3. Send crafted HTTP requests designed to match overlapping PCRE capture groups in a vulnerable rewrite directive.
4. Trigger heap buffer overflow during ngx_http_rewrite_module replacement-string handling.
5. Cause the NGINX worker process to crash and restart, creating denial-of-service conditions or instability.
6. If ASLR is disabled or bypassed, attempt to convert the heap overflow into code execution under the NGINX worker process context.

How to detect it

To determine whether exploitation has already occurred, correlate NGINX error logs, access logs, system logs, service-manager logs, and crash/core-dump artifacts. Look for NGINX worker-process crashes, segmentation faults, heap corruption messages, unexpected restarts, or core dumps. Then examine access-log entries immediately before each crash for unusual URI patterns, very long paths, heavily nested path components, encoded characters, repeated redirect-triggering requests, or repeated requests from the same source that consistently precede worker termination. On systemd-based hosts, review journal entries for nginx worker exits, segfaults, OOM-like events that are not memory-pressure related, and rapid service restarts. If core dumps are enabled, preserve them for forensic analysis and inspect whether the crashing thread is inside rewrite or PCRE-related code paths. Also hunt configuration repositories and deployed NGINX configs for risky rewrite patterns so analysts can focus log review on locations where this vulnerability is reachable.

• nginx: worker process
• worker process exited on signal 11
• worker process exited on signal 6
• segmentation fault
• segfault at
• core dumped
• malloc(): corrupted top size
• malloc(): invalid size
• free(): invalid pointer
• double free or corruption
• rewrite ^/((.*))$
• $1$2
• /var/log/nginx/error.log
• /var/log/nginx/access.log
• /var/lib/systemd/coredump/
• /var/crash/
• /cores/
• /proc/sys/kernel/randomize_va_space

What your security team should do

• Inventory NGINX Plus and NGINX Open Source deployments, prioritizing internet-facing reverse proxies, load balancers, ingress controllers, and edge gateways.
• Identify configurations using ngx_http_rewrite_module with complex regex captures, especially nested or overlapping captures referenced multiple times in redirect or arguments replacements.
• Apply vendor-fixed NGINX packages as soon as available; if fixed versions are not yet available for a branch, implement configuration-level mitigations immediately.
• Enable and verify ASLR on all affected hosts, and ensure NGINX workers run with least-privileged service accounts.
• Increase monitoring for NGINX worker crashes, segmentation faults, core dumps, and abnormal restart frequency.
• Review recent access logs around worker-crash timestamps to identify suspicious request paths that repeatedly precede crashes.
• Replace end-of-technical-support NGINX versions with supported releases that receive security fixes.
• Because the vulnerability is high severity with moderate EPSS but not currently KEV-listed, treat remediation as urgent for exposed systems with matching rewrite configurations rather than as a universal emergency for all NGINX deployments.