Use of uninitialized resource in NGINX Plus and NGINX Open Source - CVE-2026-60005

Vulnerability identifier: #VU137846

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-60005

CWE-ID: CWE-908

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose limited memory contents or cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in ngx_http_slice_module when handling requests with the slice directive and unnamed regex captures configured or during a background cache update. A remote attacker can send crafted requests to disclose limited memory contents or cause a denial of service.

The issue affects the NGINX worker process and is limited to the data plane. The module is not enabled by default and must be built with the --with-http_slice_module configuration parameter.

NGINX Plus
NGINX Open Source
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
Ubuntu
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx (Ubuntu package)
nginx-help
nginx-filesystem
nginx-all-modules
nginx-mod-stream
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-mod-devel
nginx-debugsource
nginx-debuginfo
nginx
nginx (Debian package)
nginx (Red Hat package)
nginx-doc
nginx-core
www-servers/nginx

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P7, 37.0.3.1
NGINX Open Source - addressed in versions 1.30.4, 1.31.3
nginx-mod-js-challenge - update to 0^20230517.gitda6852d-11.fc45
nginx-mod-vts - update to 0.2.4-13.fc45
nginx-mod-fancyindex - update to 0.6.0-8.fc45
nginx-mod-headers-more - update to 0.40-3.fc45
nginx-mod-brotli - update to 1.0.0~rc-13.fc45
nginx-mod-modsecurity - update to 1.0.4-16.fc45
nginx-mod-naxsi - update to 1.6-21.fc45
nginx (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.17, 1.18.0-6ubuntu14.18, 1.18.0-6ubuntu14.19, 1.18.0-6ubuntu14.20, 1.18.0-6ubuntu14.21, 1.24.0-2ubuntu7.14, 1.24.0-2ubuntu7.15, 1.24.0-2ubuntu7.16, 1.24.0-2ubuntu7.17, 1.24.0-2ubuntu7.18, 1.28.3-2ubuntu1.7, 1.28.3-2ubuntu1.8, 1.28.3-2ubuntu1.9, 1.28.3-2ubuntu1.10, 1.28.3-2ubuntu1.11
nginx-help - update to 1.21.5-19
nginx-filesystem - update to 1.21.5-19
nginx-all-modules - update to 1.21.5-19
nginx-mod-stream - update to 1.21.5-19
nginx-mod-mail - update to 1.21.5-19
nginx-mod-http-xslt-filter - update to 1.21.5-19
nginx-mod-http-perl - update to 1.21.5-19
nginx-mod-http-image-filter - update to 1.21.5-19
nginx-mod-devel - update to 1.21.5-19
nginx-debugsource - update to 1.21.5-19
nginx-debuginfo - update to 1.21.5-19
nginx - update to 1.21.5-19
nginx (Debian package) - update to 1.26.3-3+deb13u8
nginx (Red Hat package) - update to 1.26.3-6.el10_2.6
nginx-doc - update to 1.30.4-1
nginx - update to 1.30.4-1
nginx-core - update to 1.30.4-1
nginx-mod-devel - update to 1.30.4-1
nginx-mod-http-image-filter - update to 1.30.4-1
nginx-mod-http-perl - update to 1.30.4-1
nginx-mod-http-xslt-filter - update to 1.30.4-1
nginx-mod-mail - update to 1.30.4-1
nginx-mod-stream - update to 1.30.4-1
nginx-all-modules - update to 1.30.4-1
nginx-filesystem - update to 1.30.4-1
nginx - update to 1.30.4-1.fc45
www-servers/nginx - update to 1.31.3-r1

• https://my.f5.com/manage/s/article/K000162100

• Multiple vulnerabilities in NGINX Open Source
• Ubuntu update for nginx
• Ubuntu update for nginx
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Anolis OS update for nginx
• openEuler update for nginx
• Gentoo update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Red Hat Enterprise Linux 10 update for nginx
• Red Hat Enterprise Linux 9 update for the nginx:1.24 module
• Debian update for nginx
• Ubuntu update for nginx