CVE-2026-9256: Heap Buffer Overflow in NGINX Rewrite Module Enables DoS and Potential RCE

Security researchers have uncovered a significant architectural flaw in the NGINX web server, identified as CVE-2026-9256. Disclosed by F5, this vulnerability—informally dubbed “Nginx-poolslip”—resides within the ngx_http_rewrite_module and poses a substantial risk to internet-facing infrastructure.

The vulnerability is particularly concerning because it allows unauthenticated attackers to trigger a Denial-of-Service (DoS) state or, in more sophisticated scenarios, potentially achieve Remote Code Execution (RCE) by exploiting memory management errors during request processing.

Technical Breakdown: The Root Cause of Nginx-poolslip

At its core, the flaw is a heap-based buffer overflow (CWE-122). The issue stems from how the NGINX worker process handles complex, overlapping PCRE (Perl-Compatible Regular Expression) capture groups when executing rewrite directives.

When a configuration utilizes ambiguous regular expression patterns—specifically those involving nested or overlapping unnamed capture groups—the engine can struggle to accurately map backreferences to specific memory offsets. For example, a pattern like ^/((.*))$ combined with multiple backreferences (e.g., $1$2) can cause the NGINX process to write data beyond the allocated heap boundaries.

Because this occurs within the data plane, an attacker can send a specially crafted HTTP request that forces the worker process into an out-of-bounds write condition. The practical implications include:

• Service Disruption: Repeated memory corruption leads to worker process crashes, causing instability or total service downtime.
• Remote Code Execution: If an attacker can successfully bypass or predict memory layouts (overcoming protections like ASLR), they may be able to hijack the execution flow of the worker process.
• High-Traffic Instability: In production environments, even minor memory corruption can trigger cascading failures across a load-balancing cluster.

The severity is reflected in its high scoring: it holds a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 9.2 (Critical).

Affected Software and Versioning

The vulnerability impacts a broad spectrum of NGINX deployments, particularly those relying on the core rewrite module. Organizations using NGINX Ingress Controller, NGINX App Protect, or NGINX Gateway Fabric should treat this as a high-priority update.

NGINX Open Source:

• Vulnerable: Versions 1.0.0 through 1.30.1
• Patched: 1.30.2 and 1.31.1

NGINX Plus:

• Vulnerable: Version 37.0.0
• Patched: 37.0.1.1

Note: F5 enterprise products including BIG-IP, BIG-IQ, and F5 Distributed Cloud are confirmed to be unaffected by this specific flaw.

Mitigation: From Unnamed to Named Captures

While patching is the only definitive fix, administrators can mitigate the risk by auditing their configuration files. The vulnerability is triggered by the ambiguity of unnamed capture groups. To secure your configuration, you should transition to named capture groups, which explicitly define the scope of each variable and prevent overlapping memory writes.

Vulnerable Configuration Example:
rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

Secure Configuration Example (Recommended):
rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;

By utilizing (?<name>...) syntax, you remove the mathematical ambiguity that leads to the heap overflow, ensuring the PCRE engine handles the memory allocation predictably.

Action Plan for Administrators

1. Immediate Patching: Prioritize upgrading NGINX instances to the fixed versions (1.30.2+, 1.31.1+, or 37.0.1.1+).
2. Configuration Audit: Use automated tools or manual review to identify rewrite directives using multiple unnamed capture groups.
3. Implement Named Captures: Refactor all regex-heavy rewrite rules to use named groups.
4. Hardening: Ensure OS-level protections like ASLR are fully enabled to increase the difficulty of RCE exploitation.
5. Monitoring: Watch for an uptick in SIGSEGV (segmentation fault) errors in your NGINX error logs, which may indicate exploitation attempts.

This vulnerability was responsibly disclosed by researchers from Winfunc Research (Mufeed VH), Nebula Security, and Vexera AI.