https://seclists.org/oss-sec/2026/q2/671: NGINX ngx_http_write_module buffer overflow (CVE-2026-9256)
Published May 22, 2026
·Updated
Affected Software
2 affected components
Nginx NGINX Open Source<1.31.1, <1.30.2
Nginx NGINX Plus
Frequently Asked Questions
1
What is the severity of CVE-2026-9256?
CVE-2026-9256 has been classified as a high-severity buffer overflow vulnerability.
2
How do I fix CVE-2026-9256?
To fix CVE-2026-9256, upgrade to NGINX versions 1.31.1 or 1.30.2 that contain the patched code.
3
What impact does CVE-2026-9256 have on NGINX?
CVE-2026-9256 can lead to remote code execution or crashes due to buffer overflow issues.
4
Which NGINX versions are affected by CVE-2026-9256?
CVE-2026-9256 affects multiple versions of NGINX prior to the security updates in versions 1.31.1 and 1.30.2.
5
Is NGINX Plus also affected by CVE-2026-9256?
Yes, both NGINX Open Source and NGINX Plus are affected by the CVE-2026-9256 vulnerability.