CVE-2026-93479: nginx Heap Overflow in map Regex

pajus 5 min read

CVE-2026-93479 is a heap buffer overflow in the nginx worker process. It happens while nginx evaluates string expressions that contain variables. The nginx changelog says the bug affects the document root calculation and request logging in both the http and stream modules. nginx 1.31.7 (mainline) and 1.30.6 (stable) fixed it on 2026-10-14. NVD published the CVE on the same day. F5, the CNA, rates it 9.2 (Critical) under CVSS 4.0. Its CVSS 3.1 score is 8.1 (High), and the weakness is CWE-122.

What the vulnerability does

According to the CVE description, the vulnerable setup is a map block that uses regex matching, where the root directive or an access log format references the map's regex capture variables before the map's output variable. A non-cacheable variable in a string expression can lead to the same result under certain conditions. In that setup, an unauthenticated remote attacker can send crafted HTTP requests that overflow a heap buffer in the worker process. The worker then restarts. If ASLR is disabled or can be bypassed, code execution may be possible.

F5 says only the data plane is affected and the control plane is not exposed. The CVSS vectors use attack complexity High (AC:H) because some of the required conditions are outside the attacker's control.

The severity ratings differ. The nginx.org security advisories page rates CVE-2026-93479 as Medium, while F5's CVSS 4.0 score is Critical. The status box above uses the CNA's CVSS score.

Exploitation status

No exploitation is known. CVE-2026-93479 is not in the CISA KEV catalog. On NVD, the CISA ADP SSVC assessment lists Exploitation: none, Automatable: no, Technical Impact: total. NVD still shows the record as "Awaiting Analysis".

Who is affected

The nginx.org advisory lists these affected and fixed upstream versions:

BranchVulnerableFixed
nginx mainline 1.31.x1.31.2 to 1.31.61.31.7
nginx stable 1.30.x1.30.0 to 1.30.51.30.6
Debian 13 (trixie) nginx source packageMarked vulnerable by the Debian security trackerNo fixed package and no DSA yet

NGINX Plus is also affected, according to the CVE description. F5 did not evaluate versions that are past End of Technical Support.

On Debian 13, the security tracker lists both the trixie and trixie-security packages of nginx as vulnerable. Only unstable (sid) has a fixed package. Per-release status for other Debian releases is on the Debian tracker page for CVE-2026-93479.

Only some configurations are exposed. They need the variable patterns described above in root or in access logging. If a configuration has no regex map whose captures are used in those places, it does not match the main condition in the advisory. F5 has not listed every possible trigger, though (see below).

What admins should do now

If you run nginx from the nginx.org packages or build it from source, upgrade to 1.31.7 or 1.30.6 and confirm the running version:

nginx -v
systemctl restart nginx
systemctl status nginx

On Debian 13, check which package version is installed and watch for a DSA:

apt update
apt policy nginx
dpkg -l 'nginx*'

When Debian ships a fixed package, install it and restart the service. A reload does not replace the running worker binary.

apt update
apt install --only-upgrade nginx nginx-common
systemctl restart nginx

Until a patched package is available, review the effective configuration. Look at map blocks with regex keys (a ~ or ~* prefix) and at the places their captures are used in root, log_format and access_log, in both http and stream contexts:

nginx -T 2>/dev/null | grep -nE '^\s*(map|root|log_format|access_log)\b'
nginx -T 2>/dev/null | grep -nE '^\s*~\*?'

Where possible, remove regex capture variables from root and log formats, then run nginx -t before reloading. Unexpected worker restarts show up in the error log as worker process lines reporting that a worker exited on a signal. Watch for them:

grep -n 'exited on signal' /var/log/nginx/error.log

Do not turn off ASLR. Check that it is enabled (the value should be 2):

sysctl kernel.randomize_va_space

For a broader baseline, see the web server security baseline for Debian 13. Sandboxing the nginx unit limits the damage a compromised worker can do; the guide on sandboxing systemd services on Debian 13 covers this.

What we don't know yet

  • Vendor mitigations: the F5 advisory K000162607 could not be retrieved for this alert. Any F5 workarounds or NGINX Plus fixed releases are not covered here.
  • Debian 13 exposure: upstream lists only 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6 as vulnerable. The Debian tracker still marks the trixie package, which is based on an older upstream branch, as vulnerable. The tracker does not say whether the vulnerable code was backported or whether the status is provisional.
  • The "non-cacheable variable in a string expression" path is only described as working "under certain conditions". The full set of affected configurations has not been published.
  • Severity: nginx.org rates the issue Medium and the CNA rates it Critical. NVD has not published its own assessment yet.
  • No date has been announced for a Debian 13 security update.

Takeaways

  • Upgrade nginx.org and source builds to 1.31.7 or 1.30.6.
  • Debian 13: no fixed package yet. Watch the tracker and the DSA list, then upgrade and restart.
  • Until then, check whether regex map captures are used in root or log formats, and remove them where possible.
  • Keep ASLR enabled and watch for worker processes exiting on signals.

Sources

Tags