NGINX Web Server (versions 0.9.6 through 1.31.2)
NGINX is a web server used by a large portion of the internet to deliver websites and handle web traffic — it sits between your browser and the application behind it.
Root Cause
NGINX's two-pass evaluation system measures the required buffer size in one pass, then writes data in a second. A regex evaluated between passes overwrites the shared capture state. The buffer is sized for the original value but filled with attacker-controlled data, causing the overflow.
Attack Vector
A remote, unauthenticated attacker sends a crafted HTTP request. On servers where ASLR (address space layout randomisation, a memory protection mechanism) is disabled, this may enable remote code execution (RCE). One researcher argues the flaw itself can bypass ASLR on default Ubuntu 24.04 systems.
Detection Notes
Watch for unexpected NGINX worker crashes or restarts in your process logs. Unusual or malformed HTTP requests in access logs — particularly oversized or regex-heavy payloads — warrant investigation.
Recommended Actions
- Upgrade to NGINX 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1.
- If patching immediately is not possible, switch affected regex maps to named captures as a temporary mitigation.
- Monitor for unexpected worker restarts as a potential sign of active probing.