NGINX CVE-2026-60005

Exploitation requires the target to be built with the non-default ngx_http_slice_module (--with-http_slice_module) AND to be running a triggering configuration: the slice directive together with unnamed regex captures in location/rewrite rules, OR an active background cache update (proxy_cache_background_update) path. Given AV:N/PR:N/UI:N, no authentication or user interaction is needed once those server-side conditions exist, and requests come from unauthenticated remote attackers. The limiting factors that reduce real-world exposure are: the slice module must be compiled in (absent in default builds), the specific slice-plus-unnamed-regex or background-cache-update configuration must be present, and only End-of-Technical-Support-supported versions were evaluated. Impact is bounded to limited memory disclosure or worker restart - there is no control-plane exposure and no code execution.

The CVSS:4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/VI:N/VA:H) reflects remote, unauthenticated, low-complexity access with limited confidentiality impact but high availability impact - consistent with the description of limited memory disclosure or worker restart. The score is inflated relative to real-world urgency by two mitigating factors the base vector cannot capture: the vulnerable ngx_http_slice_module is not compiled by default, and exploitation further requires a specific configuration (slice plus unnamed regex captures) or an in-flight background cache update, so the exposed population is a subset of NGINX deployments. No EPSS score was provided, there is no CISA KEV entry, and no POC is referenced, so this is not confirmed as actively exploited. The realistic priority is moderate: high for the narrow set of installations that compile in the slice module and use the affected configuration, and low for the default-build majority. Impact is bounded - 'limited' disclosure and worker restart (workers respawn), not RCE or control-plane compromise - so treat this as an important but not emergency patch, prioritized by whether the slice module is actually in your build.

An attacker who identifies an internet-facing NGINX instance built with the slice module and using slice alongside unnamed regex captures sends crafted HTTP requests that drive the worker down the uninitialized-memory path, returning fragments of worker-process memory or forcing the worker to restart. With AV:N/AC:L/PR:N, this requires no authentication and no user interaction, only network reachability to the vulnerable endpoint. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector and description rather than an observed campaign.