CVE-2026-27654: NGINX ngx_http_dav_module vulnerability
Last updated 6 June 2026
Other sources
NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.29.71.28.3 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6Fixed in 1.22.1-9+deb12u6Fixed in 1.22.1-9+deb12u7Fixed in 1.26.3-3+deb13u4Fixed in 1.26.3-3+deb13u5Fixed in 1.30.1-3 - Compensating control
Review NGINX configuration to identify usage of ngx_http_dav_module MOVE or COPY methods with prefix location (nonregular expression location configuration) and alias directives; remove/avoid these DAV MOVE/COPY configurations so the vulnerable code path is not reachable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27654?
CVE-2026-27654 is classified as a high severity vulnerability that can lead to a buffer overflow in NGINX.
How do I fix CVE-2026-27654?
To fix CVE-2026-27654, update your NGINX Open Source to version 1.29.71.28.3 or NGINX Plus to version 36.
Which versions of NGINX are affected by CVE-2026-27654?
CVE-2026-27654 affects NGINX Open Source versions prior to 1.29.71.28.3 and NGINX Plus prior to version 36.
What type of attack can CVE-2026-27654 facilitate?
CVE-2026-27654 can facilitate a denial-of-service attack by terminating the NGINX worker process due to a buffer overflow.
Is there a workaround for CVE-2026-27654?
There is no known workaround for CVE-2026-27654, so upgrading to the patched versions is recommended.