NGINX Plus and NGINX Open Source CVE-2026-40701

NGINX must be explicitly configured with ALL of the following: (1) ssl_verify_client directive set to 'on' or 'optional' to enable client certificate validation, (2) ssl_ocsp directive set to 'on' AND a resolver configured (e.g., 'resolver 8.8.8.8;') for OCSP stapling or leaf certificate validation. Default NGINX configurations without client certificate validation do not expose this vulnerability. The attacker must be network-accessible to the NGINX TLS endpoint but does not require authentication. Exploitation is constrained by high attack complexity (AC:H), suggesting the attacker must satisfy specific timing, memory layout, or request sequencing conditions that are not fully detailed in available descriptions.

CVSS 4.8 with AV:N/AC:H/PR:N/UI:N/S:U 2024-indicates moderate risk constrained by high attack complexity. The network vector and lack of privilege/user interaction requirements suggest broad exposure; however, AC:H (high complexity) indicates specific conditions must align - likely related to timing, race conditions, or exact memory state manipulation. The integrity impact is None (I:N) and availability/confidentiality are Limited (A:L/C:L), confirming denial-of-service and information disclosure only, not code execution. EPSS data not provided; however, KEV status unknown suggests this is not yet confirmed actively exploited at scale. The requirement for specific NGINX configuration (ssl_verify_client + ssl_ocsp + resolver) limits real-world exposure compared to default deployments. Patch availability from F5 significantly reduces urgency for deployed environments, though organizations using NGINX for TLS client authentication and OCSP validation should prioritize updates. The use-after-free primitive creates theoretical potential for escalation on systems with certain memory layouts, but current impact is limited to process restarts and side-channel information leaks.

An attacker sends specially crafted HTTPS requests to an NGINX instance configured with ssl_verify_client set to 'on' or 'optional' and ssl_ocsp enabled with a resolver. The attacker exploits timing or memory state conditions during OCSP validation and client certificate processing to trigger a use-after-free condition in the worker process. This may result in the worker process reading or modifying freed memory, leaking sensitive data or crashing the worker process, causing brief service interruption until the worker restarts.