Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.
Impact:
This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| F5 | NGINX Plus | 37.0.0.1 – < 37.0.3.1, R36 – < R36 P7, R33 | 37.0.3.1 |
| F5 | NGINX Open Source | 1.31.2 – < 1.31.3, 1.15.8 – < 1.30.4 | 1.31.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nginx | 1.30.1-7 | — |
| Debian 13 | nginx | 1.26.3-3+deb13u8 | — |
| Debian 12 | nginx | 1.22.1-9+deb12u10 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | nginx | 1.28.3-2ubuntu1.7 | — |
| Ubuntu 24.04 LTS | nginx | 1.24.0-2ubuntu7.14 | — |
| Ubuntu 22.04 LTS | nginx | 1.18.0-6ubuntu14.17 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | nginx | No fix yet | — |
| Ubuntu Pro 18.04 LTS | nginx | No fix yet | — |
| Ubuntu Pro 16.04 LTS | nginx | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nginx | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nginx +9 | 2:1.26.3-6.el10_2.6 | RHSA-2026:59220 |
| RHEL 9 | nginx +9 | 1:1.24.0-7.module+el9.8.0+24626+085354fc.4 | RHSA-2026:59496, RHSA-2026:59490, RHSA-2026:59362 |
| RHEL 8 | nginx +8 | 1:1.24.0-3.module+el8.10.0+24644+2676a8ce.4 | RHSA-2026:59216 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nginx +11 | 1.30.4-2.hum1 | RHSA-2026:46012 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nginx +9 | 2:1.26.3-6.el10_2.6 | ALSA-2026:59220 |
| AlmaLinux 9 | nginx +9 | 1:1.24.0-7.module_el9.8.0+298+469955e3.4.alma.1 | ALSA-2026:59496, ALSA-2026:59490, ALSA-2026:59362 |
| AlmaLinux 8 | nginx +8 | 1:1.24.0-3.module_el8.10.0+4259+e9485ae5.4.alma.1 | ALSA-2026:59216 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nginx | 2:1.26.3-6.el10_2.6 | RLSA-2026:59220 |
| Rocky Linux 9 | nginx | 1:1.24.0-7.module+el9.8.0+40193+7b2d11e4.1.rocky.0.1 | RLSA-2026:59496, RLSA-2026:59490, RLSA-2026:59362 |
| Rocky Linux 8 | nginx | 1:1.24.0-3.module+el8.10.0+40144+38158758 | RLSA-2026:59216 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nginx | 1.31.3-1.1 | openSUSE-SU-2026:11295-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nginx | 1.30.4-r0 | — |
| Alpine v3.23 | nginx | 1.28.3-r6 | — |
| Alpine v3.22 | nginx | 1.28.3-r6 | — |
| Alpine v3.21 | nginx | 1.26.3-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nginx +9 | 1:1.30.4-1.amzn2023.0.1 | ALAS2023-2026-2008 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nginx +9 | 2:1.26.3-6.0.1.el10_2.6 | ELSA-2026-59220 |
| Oracle Linux 9 | nginx +9 | 1:1.24.0-7.0.1.module+el9.8.0+91007+069d25a3.4 | ELSA-2026-59496, ELSA-2026-59490, ELSA-2026-59362 |
| Oracle Linux 8 | nginx +8 | 1:1.24.0-3.0.1.module+el8.10.0+91001+0c279a1d.4 | ELSA-2026-59216 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ingress-nginx-controller-1.15 | 1.15.12-r0 | — |
| Wolfi rolling | nginx-mainline | 1.31.3-r0 | — |
| Wolfi rolling | nginx-stable | 1.30.4-r0 | — |
| Wolfi rolling | nginx-stable-package-config | 1.30.4-r5 | — |
Advisories 24
- WID-SEC-2026-2383 NGINX NGINX Plus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026
- ALSA-2026:59362 Important: nginx security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59496 Important: nginx:1.26 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59220 Important: nginx security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59490 Important: nginx:1.24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:59216 Important: nginx:1.24 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:46012 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:59496 Red Hat Security Advisory: nginx:1.26 security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:59490 Red Hat Security Advisory: nginx:1.24 security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:59362 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:59216 Red Hat Security Advisory: nginx:1.24 security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:59220 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- ELSA-2026-59490 Important: nginx:1.24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 31, 2026
- ELSA-2026-59362 Important: nginx security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 27, 2026
- RLSA-2026:59362 Important: nginx security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:59496 Important: nginx:1.26 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:59490 Important: nginx:1.24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:59220 Important: nginx security update Rocky Linux Security Advisories · Aug 25, 2026
- RLSA-2026:59216 Important: nginx:1.24 security update Rocky Linux Security Advisories · Aug 25, 2026
- ELSA-2026-59216 Important: nginx:1.24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- ELSA-2026-59220 Important: nginx security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- ELSA-2026-59496 Important: nginx:1.26 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- ALAS2023-2026-2008 Important: nginx security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 4, 2026
- openSUSE-SU-2026:11295-1 nginx-1.31.3-1.1 on GA media SUSE / openSUSE Security Updates · Jul 18, 2026
References
- https://my.f5.com/manage/s/article/K000162100 vendor-advisory patch