Skip to main content

Nginx Open Source CVE-2026-27654

| EUVDEUVD-2026-14881 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-03-24 f5 GHSA-6r46-2qjx-j5j3
Buffer Overflow Heap Overflow Nginx Nginx Open Source Nginx Plus F5
8.8
CVSS 4.0 · Vendor: f5
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send MOVE/COPY request to NGINX
  2. Exploit
    Trigger buffer overflow in ngx_http_dav_module
  3. Impact
    Modify file paths outside document root

Vulnerability Assessment

Weakness
CWE
CWE-122
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

NGINX Open Source or NGINX Plus with ngx_http_dav_module enabled. Configuration must use DAV MOVE or COPY methods combined with prefix location (non-regex) and alias directives. Remote unauthenticated attacker can trigger buffer overflow via crafted HTTP requests.
Impact

This vulnerability presents moderate to high real-world risk depending on deployment patterns. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network exploitation without authentication and low complexity, making it technically straightforward to exploit once vulnerable configurations are identified. However, exploitation requires the specific combination of DAV module usage with prefix locations and alias directives, which is not a default configuration and is relatively uncommon in production environments. The high availability impact (A:H) reflects worker process crashes leading to service disruption, while the low integrity impact (I:L) is constrained by limited worker process privileges. No EPSS score, KEV listing, or public POC information is provided in the intelligence, suggesting this is likely a recently disclosed vulnerability without active exploitation observed yet. Organizations using WebDAV functionality in NGINX should prioritize this based on configuration matching rather than treating it as universally critical.
Exploit ScenarioDerived

An unauthenticated attacker identifies an NGINX server with WebDAV enabled and configured using prefix locations with alias directives. The attacker crafts malicious HTTP requests using DAV MOVE or COPY methods with specially crafted destination paths that trigger the heap buffer overflow in the worker process. This causes worker process crashes leading to denial of service, or in more sophisticated attacks, allows manipulation of file paths to write or move files outside the intended document root boundaries, potentially affecting system integrity despite limited worker process privileges.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 24, 2026

Buffer overflow in NGINX's DAV module allows remote attackers to crash worker processes or manipulate file names outside the document root when MOVE/COPY methods are combined with prefix location and alias directives. The vulnerability affects NGINX Open Source and NGINX Plus installations using vulnerable configurations, though the low-privilege worker process context limits the scope of file manipulation. No patch is currently available for this high-severity issue.

Earlier versions of this analysis (1)
v1 Mar 24, 2026 - 14:45 CVSS 8.8

A buffer overflow vulnerability exists in the ngx_http_dav_module of NGINX Open Source and NGINX Plus that allows remote attackers to crash worker processes or manipulate file paths outside the document root. The flaw is exploitable when configurations use DAV MOVE or COPY methods combined with prefix locations and alias directives. With a CVSS score of 8.2 and network-accessible attack vector requiring no authentication, this represents a significant availability and integrity risk for vulnerable deployments.

RemediationAI

Consult the F5 security advisory at https://my.f5.com/manage/s/article/K000160382 for specific patched versions and upgrade immediately to the recommended release for your NGINX Open Source or NGINX Plus deployment. As an interim mitigation while planning upgrades, review NGINX configuration files to identify instances where the ngx_http_dav_module is enabled with MOVE or COPY methods alongside prefix location blocks using alias directives, and either disable DAV methods, convert prefix locations to exact or regex matches, or replace alias directives with root directives where functionally acceptable. Additionally, implement network-level access controls to restrict WebDAV endpoint access to authenticated and authorized clients only, reducing the attack surface until patching is complete.

Affected VersionsENISA

NGINX Plus R34 <*
NGINX Open Source 1.29.0 <1.29.7
NGINX Plus R35 <R35 P2
NGINX Plus R32 <R32 P5
NGINX Plus R36 <R36 P3
NGINX Open Source 0.5.13 <1.28.3
NGINX Plus R33 <*

Affected Packages

euvd nginx_open_source fix: 1.28.3, 1.29.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects the WebDAV (Web Distributed Authoring and Versioning) implementation in NGINX's ngx_http_dav_module, specifically impacting both NGINX Open Source (cpe:2.3:a:f5:nginx_open_source) and NGINX Plus (cpe:2.3:a:f5:nginx_plus). The root cause is CWE-122 (Heap-based Buffer Overflow), which occurs when processing MOVE or COPY operations in configurations that combine prefix-based location blocks with alias directives. The buffer overflow can corrupt memory in the NGINX worker process, leading to either process termination or allowing attackers to modify source/destination filenames beyond intended document root boundaries. The vulnerability manifests only in specific configuration scenarios where all three elements are present: DAV methods enabled, prefix location matching, and alias path rewriting.

Know when Nginx Open Source gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat 8.2 HIGH

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
Low
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 10, 2026 - 08:30 nvd
Patch available
CVE Published
Mar 24, 2026 - 14:13 nvd
HIGH 8.8

DescriptionCVE.org

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Zero Day Initiative Advisories

ZDI-26-578 NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability Aug 2026

Executive ViewAI

Why It Matters

A high-severity buffer overflow in NGINX's DAV module (CVE-2026-27654) poses immediate risk to organizations running vulnerable versions, potentially enabling service disruption or unauthorized file access. With no patch currently available and a CVSS score of 8.2, this vulnerability requires urgent mitigation to protect web infrastructure and business continuity.

Business Impact: High
Compensating Controls

Disable HTTP DAV methods (MOVE, COPY) via NGINX configuration if not operationally required; implement Web Application Firewall (WAF) rules to detect and block malformed DAV requests; segment affected NGINX servers from critical systems; enable request logging and alerting for suspicious MOVE/COPY activity; consider reverse proxy or load balancer rules to restrict DAV method access to trusted clients only; monitor NGINX error logs for segmentation faults or worker process crashes.

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

64
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Related Vulnerabilities in NGINX Multiple Module Vulnerabilities

View all 6
CVE-2026-28753 MEDIUM
6.3
CVE-2026-28755 MEDIUM
5.3
CVE-2026-27651 HIGH
8.7
CVE-2026-27784 HIGH
8.5
CVE-2026-32647 HIGH
8.5

More in Nginx Open Source

View all
CVE-2026-42945 CRITICAL POC
9.2 May 13

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
CVE-2026-42530 CRITICAL POC
9.2 Jun 17

Use-after-free in NGINX Open Source's ngx_http_v3_module allows remote unauthenticated attackers to crash worker process
CVE-2026-42055 CRITICAL POC
9.2 Jun 17

Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups
CVE-2026-9256 CRITICAL POC
9.2 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated rem
CVE-2026-42533 CRITICAL POC
9.2 Jul 15

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D
CVE-2026-97205 CRITICAL
9.2 Oct 14

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O
CVE-2026-93479 CRITICAL
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma
CVE-2026-15176 CRITICAL
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr
CVE-2026-60005 HIGH
8.8 Jul 15

Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6906 ADVISORY https://access.redhat.com/errata/RHSA-2026:6907 ADVISORY https://access.redhat.com/errata/RHSA-2026:6923 ADVISORY https://access.redhat.com/errata/RHSA-2026:7002 ADVISORY https://access.redhat.com/errata/RHSA-2026:7343 ADVISORY https://my.f5.com/manage/s/article/K000160382 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27654 ADVISORY https://ubuntu.com/security/notices/USN-8375-1 ADVISORY https://vuldb.com/vuln/352782 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:13634 REF https://access.redhat.com/errata/RHSA-2026:13680 REF https://access.redhat.com/errata/RHSA-2026:13839 REF https://access.redhat.com/errata/RHSA-2026:14836 REF https://access.redhat.com/errata/RHSA-2026:15942 REF https://access.redhat.com/errata/RHSA-2026:15943 REF https://access.redhat.com/errata/RHSA-2026:15945 REF https://access.redhat.com/errata/RHSA-2026:15966 REF https://access.redhat.com/errata/RHSA-2026:8346 REF https://access.redhat.com/security/cve/CVE-2026-27654 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450776 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27654.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy