CVE-2026-60005: NGINX ngx_http_slice_module vulnerability
Last updated 20 July 2026
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-7 - Configuration
If the ngx_http_slice_module is not required, disable it by removing the --with-http_slice_module build configuration parameter so the module (and the slice directive / unnamed regex captures behavior) is not available.
NGINX ngx_http_slice_module (ngx_http_slice_module module / slice directive) --with-http_slice_module = not enabled - Compensating control
If disabling the module is not immediately possible, prevent unauthenticated external access to the NGINX locations that use the slice directive (and any configurations involving unnamed regex captures) using network controls such as allowlisting/ACLs or a WAF rule so attackers cannot reach those endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60005?
The severity of CVE-2026-60005 is high, with a CVSS score of 8.2.
How do I fix CVE-2026-60005?
To fix CVE-2026-60005, update NGINX Plus or NGINX Open Source to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-60005?
CVE-2026-60005 affects NGINX Plus and NGINX Open Source implementations using the ngx_http_slice_module.
What type of vulnerability is CVE-2026-60005?
CVE-2026-60005 is a vulnerability that allows uninitialized memory access, potentially leading to information disclosure.
Can unauthenticated users exploit CVE-2026-60005?
Yes, unauthenticated attackers can exploit CVE-2026-60005 if specific configurations are in place.