Skip to main content

Nginx CVE-2026-34830

| EUVDEUVD-2026-18390 MEDIUM
Permissive Regular Expression (CWE-625)
2026-04-02 security-advisories@github.com GHSA-qv7j-4883-hwh7
Nginx Code Injection Red Hat Suse
5.9
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Patch released
Apr 03, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 02, 2026 - 17:22 euvd
EUVD-2026-18390
Analysis Generated
Apr 02, 2026 - 17:22 vuln.today
CVE Published
Apr 02, 2026 - 17:16 nvd
MEDIUM 5.9

DescriptionGitHub Advisory

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

AnalysisAI

Rack::Sendfile in versions prior to 2.2.23, 3.1.21, and 3.2.6 allows remote attackers to inject regex metacharacters into X-Accel-Mapping request headers, enabling unescaped interpolation that manipulates the X-Accel-Redirect response header and causes nginx to serve unintended files from internal locations. No public exploit code or active exploitation has been confirmed; patch versions are available from the vendor.

Technical ContextAI

Rack is a modular Ruby web server interface that provides middleware components for HTTP request/response handling. The vulnerable component, Rack::Sendfile, implements acceleration for file downloads by delegating to nginx via X-Accel-Redirect headers (also known as x-accel-redirect). The Sendfile middleware uses the X-Accel-Mapping request header to rewrite file paths for internal nginx location directives. The vulnerability stems from CWE-625 (Unsafe Regular Expression Complexity) where user-supplied input from the X-Accel-Mapping header is directly interpolated into a regular expression pattern without escaping metacharacters. This allows attackers to craft regex patterns that match unintended file paths, causing nginx to redirect file serving to arbitrary configured internal locations rather than the intended target.

RemediationAI

Upgrade Rack to version 2.2.23 (for 2.2.x branch), 3.1.21 (for 3.1.x branch), or 3.2.6 (for 3.2.x branch) or later. For Rails applications, this typically requires updating the Gemfile and running bundle update rack, then redeploying. No workarounds are available short of disabling Rack::Sendfile or removing X-Accel-Mapping support entirely. Verify that your application's Gemfile.lock specifies one of the patched versions after remediation. Additional defense-in-depth: ensure nginx x-accel-redirect internal locations are explicitly defined and as restrictive as possible to limit the blast radius of any path manipulation. See vendor advisory at https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 for details.

More in Nginx

View all
CVE-2013-2028 HIGH POC
7.5 Jul 20

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
CVE-2025-1974 CRITICAL POC
9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
CVE-2013-4547 HIGH POC
7.5 Nov 23

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
CVE-2023-50919 CRITICAL POC
9.8 Jan 12

An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2017-7529 HIGH
7.5 Jul 13

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
CVE-2016-0742 HIGH
7.5 Feb 15

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
CVE-2025-1098 HIGH POC
8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
CVE-2025-1097 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
CVE-2022-31137 CRITICAL POC
9.8 Jul 08

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
CVE-2014-3556 MEDIUM
6.8 Dec 29

The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and

CVE-2026-42945 CRITICAL POC
9.2 May 13

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker

Same weakness CWE-625 – Permissive Regular Expression

View all
CVE-2026-32973 HIGH
8.8
CVE-2018-8926 HIGH
8.8
CVE-2026-23651 MEDIUM
6.7
CVE-2020-8910 MEDIUM
6.5
CVE-2026-34763 MEDIUM
5.3

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-34830 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy