NGINX CVE-2026-93479

Exploitation requires a specific nginx configuration: a map directive using regex matching where the root directive or the access log format references the map's regex capture variables BEFORE referencing the map output variable; alternatively, use of a non-cacheable variable in a string expression under certain conditions. This is a non-default configuration pattern, not present in a stock nginx install. The attacker is unauthenticated (PR:N) and needs only to send crafted HTTP requests over the network (AV:N), but reliability is limited by 'conditions beyond their control' (AC:H). Code execution (as opposed to worker-process DoS) is further limited to systems where ASLR is disabled or the attacker can otherwise bypass ASLR; on default modern systems with ASLR enabled, the realistic outcome is a denial of service via worker restart.

F5 rates this CVSS 4.0 9.2 (Critical), driven by network vector (AV:N), no privileges (PR:N), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). However, the vector also sets AC:H, and the description explicitly states exploitation requires 'conditions beyond their control' - this is the dominant risk-lowering signal. The reliable, repeatable outcome is a worker-process heap overflow causing a restart (DoS); full code execution is explicitly gated on ASLR being disabled or the attacker being able to bypass ASLR, which is uncommon on modern default deployments. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so probability-of-exploitation and active-exploitation signals are absent and cannot be used to raise or confirm priority. There is also no control-plane exposure - F5 scopes this strictly to the data plane. Net assessment: a genuinely high-CVSS issue in an extremely widely deployed product, but real-world weaponization is constrained by a specific non-default configuration pattern, attacker-uncontrollable timing/conditions (AC:H), and an ASLR precondition for the RCE path; treat as a high-priority patch for affected nginx deployments using regex map directives, but the headline 9.2 overstates the likelihood of reliable remote code execution.

An unauthenticated attacker sends crafted HTTP requests to an nginx instance whose configuration uses a regex-matching map directive where the root directive or access log format references the map's regex capture variables before the map output variable (or uses a non-cacheable variable in a string expression under specific conditions). This corrupts the heap in the worker process, typically crashing and restarting it (DoS); on systems where ASLR is disabled or bypassable, the corruption may be leveraged for code execution. No public exploit code was identified in the provided data, and the AC:H rating reflects that success depends on conditions outside the attacker's control.