CVE-2026-60005: NGINX ngx_http_slice_module vulnerability
Last updated 20 July 2026
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-7 - Configuration
Ensure the ngx_http_slice_module is not enabled (do not build/install NGINX with --with-http_slice_module) because the module is not enabled by default and the vulnerability is in ngx_http_slice_module.
NGINX ngx_http_slice_module module --with-http_slice_module = not enabled - Compensating control
Since this is a data-plane issue (no control plane exposure), restrict network access to the NGINX endpoints that could trigger the vulnerable behavior to reduce the ability of remote, unauthenticated attackers to send requests causing uninitialized memory access or worker restarts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60005?
The severity of CVE-2026-60005 is high, with a CVSS score of 8.2.
How do I fix CVE-2026-60005?
To fix CVE-2026-60005, update NGINX Plus or NGINX Open Source to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-60005?
CVE-2026-60005 affects NGINX Plus and NGINX Open Source implementations using the ngx_http_slice_module.
What type of vulnerability is CVE-2026-60005?
CVE-2026-60005 is a vulnerability that allows uninitialized memory access, potentially leading to information disclosure.
Can unauthenticated users exploit CVE-2026-60005?
Yes, unauthenticated attackers can exploit CVE-2026-60005 if specific configurations are in place.