F5-K000162607: Buffer Overflow

Q: Which deployments are exposed to this issue?

The issue affects NGINX Plus and NGINX Open Source, including the listed F5 products that use them: NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, F5 WAF for NGINX, and F5 DoS for NGINX. Exposure depends on the relevant NGINX configuration conditions being present.

Q: What configuration conditions should be checked during triage?

Check for map directives using regular-expression matching where the root directive or access-log format references the map regex capture variables before the map output variable. Also check for non-cacheable variables used in string expressions under the stated conditions.

Q: Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can send crafted HTTP requests, although exploitation also depends on conditions beyond the attacker’s control.

Q: What is the likely impact if exploitation succeeds?

The vulnerability can cause a heap buffer overflow in an NGINX worker process and lead to a restart. Code execution is possible on systems with ASLR disabled or where the attacker can bypass ASLR.

Published Oct 14, 2026

Updated

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Affected Software

12 affected componentsFixes available

F5 NGINX Plus>=37.0.0<=37.0.4

37.0.5.1

F5 NGINX Plus=33

F5 NGINX Open Source>=1.31.2<=1.31.6, >=1.30.0<=1.30.5

1.31.71.30.6

F5 NGINX Instance Manager>=2.18.0<=2.23.0

2.24.0

F5 F5 WAF for NGINX=5.15.0, >=5.9.0<=5.14.1

5.16.05.14.2

F5 F5 DoS for NGINX>=4.8.0<=4.10.0

4.11.0

F5 NGINX Gateway Fabric>=2.1.0<=2.7.2

2.8.0

F5 NGINX Gateway Fabric>=1.5.0<=1.6.2

F5 NGINX Ingress Controller>=3<=2026, =2026

F5 NGINX Ingress Controller>=5.0.0<=5.6.3

5.7.0

F5 NGINX Ingress Controller>=4.0.0<=4.0.1

F5 NGINX Ingress Controller>=3.7.1<=3.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.5.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0

Event History

Oct 14, 2026

Advisory Published

via F5·01:36 PM

Data Sourced

via F5·01:36 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects NGINX Plus and NGINX Open Source, including the listed F5 products that use them: NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, F5 WAF for NGINX, and F5 DoS for NGINX. Exposure depends on the relevant NGINX configuration conditions being present.

What configuration conditions should be checked during triage?

Check for map directives using regular-expression matching where the root directive or access-log format references the map regex capture variables before the map output variable. Also check for non-cacheable variables used in string expressions under the stated conditions.

Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can send crafted HTTP requests, although exploitation also depends on conditions beyond the attacker’s control.

What is the likely impact if exploitation succeeds?

The vulnerability can cause a heap buffer overflow in an NGINX worker process and lead to a restart. Code execution is possible on systems with ASLR disabled or where the attacker can bypass ASLR.

F5-K000162607: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What configuration conditions should be checked during triage?

Does exploitation require authentication or user interaction?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What configuration conditions should be checked during triage?

Does exploitation require authentication or user interaction?

What is the likely impact if exploitation succeeds?