Heap-based buffer overflow in NGINX Plus and NGINX Open Source - CVE-2026-9256

Vulnerability identifier: #VU132220

CSH Severity: Critical

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-9256

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to heap-based buffer overflow in ngx_http_rewrite_module when processing crafted HTTP requests that trigger rewrite directives using overlapping PCRE captures and multiple capture references in a redirect or arguments context. A remote attacker can send crafted HTTP requests to execute arbitrary code or crash the web server.

There is no control plane exposure; this is a data plane issue only. Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed.

NGINX Plus
NGINX Open Source
Gentoo Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
Debian Linux
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
Server Applications Module
openSUSE Leap
openEuler
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx (Ubuntu package)
nginx-mod-naxsi
nginx (Red Hat package)
nginx-help
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-mod-devel
nginx-debugsource
nginx-debuginfo
nginx
nginx-mod-stream
nginx-all-modules
nginx-filesystem
nginx-source
nginx (Debian package)
nginx-core
nginx-doc
www-servers/nginx

Install security update from vendor's website.

NGINX Plus - addressed in versions R32 P7, R36 P5, 37.0.1.1
NGINX Open Source - addressed in versions 1.30.2, 1.31.1
nginx-mod-js-challenge - update to 0^20230517.gitda6852d-8.fc44
nginx-mod-vts - addressed in versions 0.2.4-10.fc43, 0.2.4-10.fc44
nginx-mod-fancyindex - addressed in versions 0.6.0-5.fc43, 0.6.0-5.fc44
nginx-mod-headers-more - addressed in versions 0.39-10.fc43, 0.39-10.fc44
nginx-mod-brotli - addressed in versions 1.0.0~rc-10.fc43, 1.0.0~rc-10.fc44
nginx-mod-modsecurity - addressed in versions 1.0.4-11.fc43, 1.0.4-11.fc44
nginx (Ubuntu package) - addressed in versions 1.4.6-1ubuntu3.9+esm6, 1.10.3-0ubuntu0.16.04.5+esm7, 1.14.0-0ubuntu1.11+esm2, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.12, 1.24.0-2ubuntu7.9, 1.28.0-6ubuntu1.4, 1.28.3-2ubuntu1.2
nginx-mod-naxsi - addressed in versions 1.6-18.fc43, 1.6-18.fc44
nginx (Red Hat package) - addressed in versions 1.20.1-28.el9_8.3, 1.26.3-6.el10_2.4
nginx-help - update to 1.21.5-15
nginx-mod-mail - update to 1.21.5-15
nginx-mod-http-xslt-filter - update to 1.21.5-15
nginx-mod-http-perl - update to 1.21.5-15
nginx-mod-http-image-filter - update to 1.21.5-15
nginx-mod-devel - update to 1.21.5-15
nginx-debugsource - update to 1.21.5-15
nginx-debuginfo - update to 1.21.5-15
nginx - update to 1.21.5-15
nginx-mod-stream - update to 1.21.5-15
nginx-all-modules - update to 1.21.5-15
nginx-filesystem - update to 1.21.5-15
nginx-source - addressed in versions 1.21.5-150400.3.20.1, 1.21.5-150600.10.21.1
nginx-debugsource - addressed in versions 1.21.5-150400.3.20.1, 1.21.5-150600.10.21.1
nginx - addressed in versions 1.21.5-150400.3.20.1, 1.21.5-150600.10.21.1
nginx-debuginfo - addressed in versions 1.21.5-150400.3.20.1, 1.21.5-150600.10.21.1
nginx (Debian package) - addressed in versions 1.22.1-9+deb12u8, 1.26.3-3+deb13u6
nginx-mod-http-perl - update to 1.30.2-1
nginx - update to 1.30.2-1
nginx-core - update to 1.30.2-1
nginx-mod-devel - update to 1.30.2-1
nginx-filesystem - update to 1.30.2-1
nginx-doc - update to 1.30.2-1
nginx-all-modules - update to 1.30.2-1
nginx-mod-stream - update to 1.30.2-1
nginx-mod-mail - update to 1.30.2-1
nginx-mod-http-xslt-filter - update to 1.30.2-1
nginx-mod-http-image-filter - update to 1.30.2-1
nginx - addressed in versions 1.30.2-1.fc43, 1.30.2-1.fc44
www-servers/nginx - update to 1.31.3-r1

• Exploit #12944 - CyberMeowfia (PoCs and exploits for CVEs discovered by NebuSec. ) (August 21, 2026)

• https://my.f5.com/manage/s/article/K000161377

• Remote code execution in NGINX ngx_http_rewrite_module module
• Fedora 44 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 43 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Anolis OS update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx
• openEuler update for nginx
• Debian update for nginx
• SUSE update for nginx
• SUSE update for nginx
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Red Hat Enterprise Linux 9 update for nginx
• Red Hat Enterprise Linux 9 update for the nginx:1.26 module
• Red Hat Enterprise Linux 10 update for nginx
• Gentoo update for nginx