F5-K000162100: High severity F5 NGINX Plus vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.31.30.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.13.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026-
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using NGINX Plus or NGINX Open Source are exposed when ngx_http_slice_module is configured with the slice directive and unnamed regular-expression captures. The issue can also be triggered when a background cache update occurs.
Does an attacker need credentials or user interaction to exploit it?
No. The issue can be triggered by unauthenticated attackers sending requests, and no user interaction is required.
What could exploitation do to an affected worker?
Exploitation may cause uninitialized-memory access in an NGINX worker process. The reported impacts are limited disclosure of memory or a worker restart.