CVE-2026-9256: nginx rewrite Module Heap Buffer Overflow, CVSS 9.2, Multiple Versions Affected

A heap buffer overflow exists in the nginx and NGINX Plus rewrite module. When a rewrite directive uses a regex with overlapping capture groups, an unauthenticated attacker can send a crafted HTTP request to trigger the overflow and potentially execute code.

In May 2026, security researchers Mufeed VH (Winfunc Research), Nebula Security, and Vexera AI jointly disclosed CVE-2026-9256, a critical vulnerability in nginx and NGINX Plus. The flaw is in nginx's rewrite module, can cause a heap buffer overflow, and under certain conditions may lead to code execution.

Incident Overview

CVE-2026-9256 affects nginx's `ngx_http_rewrite_module`. A heap buffer overflow can occur when a rewrite directive uses a regex with clearly overlapping PCRE capture groups (for example `^/((.*))$`) and the replacement string references multiple such groups (for example `$1$2`).

F5 (the nginx vendor) confirmed that an unauthenticated attacker can exploit this with a crafted HTTP request when specific conditions are met. That can crash and restart nginx worker processes. On systems with ASLR disabled, or where an attacker can bypass ASLR, it may lead to code execution.

Technical Details

Root Cause

The root cause is incorrect internal memory handling when a rewrite directive processes a regex with overlapping capture groups. When the replacement string references multiple overlapping groups, the internal buffer size calculation can be wrong, causing a heap buffer overflow.

Affected versions:

• nginx Open Source: 0.1.17 – 0.9.7, 1.30.0 – 1.30.1, 1.31.0
• NGINX Plus: R32 (pre-fix), R36 (pre-fix), R37 (pre-fix)

CVSS Scores

| Version | Score | Severity | Vector | | --- | --- | --- | --- | | CVSS 4.0 | 9.2 | Critical | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | | CVSS 3.1 | 8.1 | High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |

Note the CVSS 4.0 score is 9.2 (Critical), but attack complexity is high (AC:H) and specific config conditions are required to trigger it.

Impact Assessment

Exploitation Conditions

Exploitation requires all of the following:

• A rewrite directive is present in the nginx config
• The regex has overlapping capture groups
• The replacement string references multiple such groups
• Used in a redirect or argument context

Conditions are strict, but nginx is one of the most widely used web servers globally, so any critical flaw in it can affect a large amount of internet infrastructure.

Practical Impact

• Heap buffer overflow crashes and restarts worker processes
• Possible code execution on systems with ASLR disabled
• Can be used for denial-of-service

Remediation

Official Patches

F5 has released fixed versions:

• nginx Open Source: upgrade to 1.31.1 or later
• NGINX Plus R32: apply R32 P7 or later
• NGINX Plus R36: apply R36 P5 or later
• NGINX Plus R37: apply R37.0.1.1 or later

Temporary Mitigations

If you cannot upgrade immediately, consider:

• Review rewrite directives in nginx configs for overlapping capture groups
• Rewrite regexes to avoid clearly overlapping capture groups
• Place a WAF in front of the reverse proxy to filter suspicious HTTP requests

Detection

• Check whether the nginx version is in the affected range
• Check configs for rewrite rules with overlapping capture groups
• Monitor nginx worker processes for unexpected restarts

References

• F5 security advisory K000161377
• CVE.org CVE-2026-9256
• NVD CVE-2026-9256 details
• OSS-Security mailing list disclosure