Among the five fixes in NGINX 1.30.6 and 1.31.7, CVE-2026-93479 is unusual because it is a regression introduced by a previous security fix. The flaw lives in the same string-handling code NGINX hardened in July 2026 for CVE-2026-42533, and the affected branches, 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6, begin before that July change. A server that was patched in July is inside the affected range either way.

What went wrong in July

The July patch added protection against overrunning a buffer in the code path that builds strings from regex map captures. Data could still spill into a reserved area, however, and a second July commit then sized the final string from that spilled length. The result was a string that could outgrow its own buffer: the guard prevented the original overflow but permitted a length calculation that made a new one possible.

F5 rates the resulting bug 9.2 Critical on CVSS v4.0, the same score as the two other memory bugs in the October release. The credentials go to Matt Suiche of Tolmo and Mateusz Gierblinski.

The trigger

The flaw needs a regex map whose capture groups are referenced by root or by log_format, and it needs that reference to be evaluated before the map output variable resolves. Under those conditions the overflow is bounded by the size of the reserved area on the document-root path, and by a single null byte on the access-log path.

That boundedness is worth stating plainly because it shapes the impact. This is not an unbounded write into arbitrary memory. It is a controlled overrun whose practical effect depends on what sits adjacent to the reserved region, and F5's advisory still classifies it as a heap overflow that can crash a worker and potentially allow code execution.

Why the map pattern is common

Regex maps are the idiomatic way to derive variables from request attributes in NGINX. A map that matches a User-Agent against patterns to produce a device class, or matches a path against patterns to produce a backend name, is ordinary configuration. Named captures make those maps easier to read, and named captures are exactly the mechanism the July workaround recommended.

That is why the July workaround drew criticism. Researcher Stan Shaw told The Hacker News that switching to named captures left a narrower path open and that upgrading was the only complete fix. The October regression confirms the direction of that criticism: the named-capture advice was never a complete substitute for a patched binary.

Exploitation conditions and impact

An attacker needs to reach a location whose root or log_format consumes a captured group from a regex map. The overflow then occurs during normal request processing, with no authentication required beyond whatever the location already demands.

The impact follows the usual two-track pattern for worker-process memory corruption: a crash that degrades availability, and the possibility of code execution inside the worker. Because the overflow is bounded, exploitation is not automatic, but bounded overruns of a null byte or a reserved-region-sized write are still meaningful primitives in the right memory layout.

Remediation

Upgrade to 1.30.6 or 1.31.7.

F5's workaround is to use named captures, and to use them only inside the block that contains the regex match, so that the capture values never reach a root or log_format consumer in the vulnerable order. Given that this is the pattern the July patch was supposed to secure, teams applying the workaround should treat it as a stopgap measured in days, not months.

A second, cleaner option for many deployments is to break the dependency entirely: derive the value with a different mechanism, such as a map on a literal prefix plus a root that does not interpolate capture groups. That removes the code path from the request rather than trying to satisfy its preconditions safely.

Checking a server

Run nginx -T and locate every map block that uses a regex pattern with captures. Then find whether the resulting variable, or the capture names themselves, appear in a root directive or a log_format definition. Where the two meet, the server matched the vulnerable pattern before the upgrade.

The flaw does not appear in a banner or a version string, and a scanner cannot distinguish a patched from an unpatched 1.30.5 from outside. Configuration review plus a correct package version is the only reliable evidence.

Sources

  • NGINX security advisories: https://nginx.org/en/security_advisories.html

  • F5 advisory K000162607: https://my.f5.com/manage/s/article/K000162607

  • Map handling fix commit: https://github.com/nginx/nginx/commit/6aa4b3fdd4fdc156153f2981eb4070690624447c

  • Follow-up length fix commit: https://github.com/nginx/nginx/commit/a8289aa69c74f7e664ad63b91c17aa2a554f190f

  • NGINX download page: https://nginx.org/en/download.html