CVE-2026-9256

NGINX ngx_http_rewrite_module vulnerability

HIGH

8.1

CVSS Score

Published: May 22, 2026 at 02:11 PM UTC

Updated: August 25, 2026 at 01:40 PM UTC

13 products affected across 3 vendorsDebian LinuxEnterprise LinuxHardened Images

Using NGINX Plus by F5?

Get instant alerts when new vulnerabilities affect NGINX Plus - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 11%

SSVC

No known exploit

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Dos · F5

95%

4.3.0 ≤ v ≤ 4.7.04.9.0

NGINX Gateway Fabric · F5

95%

1.3.0 ≤ v ≤ 1.6.22.0.0 ≤ v < 2.6.2

Affected range stops below 2.6.2, so it looks safe — our inference, not a vendor statement

NGINX Ingress Controller · F5

95%

3.5.0 ≤ v ≤ 3.7.24.0.0 ≤ v ≤ 4.0.15.0.0 ≤ v < 5.4.3

Affected range stops below 5.4.3, so it looks safe — our inference, not a vendor statement

NGINX Instance Manager · F5

95%

2.17.0 ≤ v < 2.22.1

Affected range stops below 2.22.1, so it looks safe — our inference, not a vendor statement

NGINX Open Source · F5

95%

0.1.17 ≤ v ≤ 0.9.71.0.0 ≤ v < 1.30.21.30.0 ≤ v < 1.30.21.31.0 ≤ v < 1.31.10.1.17 1.30.0 1.31.0

Affected range stops below 1.30.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.31.1, so it looks safe — our inference, not a vendor statement

NGINX Plus · F5

95%

37.0 ≤ v < 37.0.1.1R32 ≤ v < R32 P7R36 ≤ v < R36 P5r33 ≤ v < r3637.0 37.0.0.1R32R36 r32 r32 p1 r32 p2 r32 p3 r32 p4 r32 p5 r32 p6 r36 r36 p1 r36 p2 r36 p3 r36 p4

Affected range stops below 37.0.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below R32 P7, so it looks safe — our inference, not a vendor statement

Affected range stops below R36 P5, so it looks safe — our inference, not a vendor statement

Affected range stops below r36, so it looks safe — our inference, not a vendor statement

Waf · F5

95%

4.10.0 ≤ v ≤ 4.16.05.2.0 ≤ v ≤ 5.8.05.9.0 ≤ v ≤ 5.13.0

Discovery · Red Hatcontainer

95%

All versions

Vendor states this is fixed in 1782756541 (unaffected)

Enterprise Linux · Red Hatrpm

95%

10.0 8.0 9.0

Vendor states this is fixed in 2:1.20.1-28.el9_8.3 (unaffected)

Vendor states this is fixed in 2:1.26.3-6.el10_2.4 (unaffected)

Vendor states this is fixed in 8100020260611094050.489197e6 (unaffected)

Vendor states this is fixed in 9080020260609152155.9 (unaffected)

Vendor states this is fixed in 9080020260610161820.9 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://my.f5.com/manage/s/article/K000161377

References (15)

Vendor AdvisoryMitigation

Source: cverecord

https://my.f5.com/manage/s/article/K000161377

Mailing List

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/05/22/14

Mailing ListThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html

Third Party Advisory