CVE-2026-27654

NGINX ngx_http_dav_module vulnerability

HIGH

8.2

CVSS Score

Published: March 24, 2026 at 02:13 PM UTC

Updated: July 15, 2026 at 02:19 AM UTC

2 products affected across 1 vendorNGINX PlusNGINX Open Source

Using NGINX Open Source by F5?

Get instant alerts when new vulnerabilities affect NGINX Open Source - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.2

Exploit prediction

EPSS 26%

SSVC

No known exploit

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

NGINX Open Source · F5

95%

0.5.13 ≤ v ≤ 0.9.70.5.13 ≤ v < 1.28.31.0.0 ≤ v < 1.28.31.29.0 ≤ v < 1.29.70.5.13 1.29.0

Affected range stops below 1.28.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.29.7, so it looks safe — our inference, not a vendor statement

NGINX Plus · F5

95%

v ≥ R33v ≥ R34R32 ≤ v < R32 P5R35 ≤ v < R35 P2R36 ≤ v < R36 P3R32 R33 R34 R35 R36 r32 p1 r32 p2 r32 p3 r32 p4r33r33 p1 r33 p2 r33 p3r34r34 p1 r34 p2r35r35 p1 r36 r36 p1 r36 p2

Affected range stops below R32 P5, so it looks safe — our inference, not a vendor statement

Affected range stops below R35 P2, so it looks safe — our inference, not a vendor statement

Affected range stops below R36 P3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://my.f5.com/manage/s/article/K000160382