Nginx-poolslip Flaw Exposes Servers to DoS and Code Execution Attacks

NGINX users are facing a critical security issue after F5 disclosed a new vulnerability, tracked as CVE-2026-9256, affecting the widely used ngx_http_rewrite_module.

The flaw, dubbed “Nginx-poolslip,” can allow attackers to trigger denial-of-service (DoS) conditions and, under certain conditions, achieve remote code execution.

Nginx-poolslip Flaw

The issue originates from improper handling of overlapping PCRE (Perl-Compatible Regular Expression) capture groups in rewrite directives.

When configurations use ambiguous regular expression patterns, such as ^/((.*))$, combined with multiple backreferences like $1$2, memory corruption can occur.

This leads to a heap-based buffer overflow (CWE-122) within the NGINX worker process. Attackers can exploit the flaw by sending specially crafted HTTP requests without requiring authentication.

Successful exploitation can result in:

• Denial-of-service (DoS) due to worker process crashes and restarts
• Potential remote code execution, especially if protections like ASLR are turned off or bypassed
• Service instability in high-traffic production environments

Although the vulnerability affects only the data plane and does not expose the control plane, its remote exploitability makes it a serious risk for internet-facing systems.

The vulnerability has been assigned a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 9.2 (Critical), reflecting its potential severity in real-world deployments.

Affected Versions

The flaw affects both NGINX Open Source and NGINX Plus deployments:

• NGINX Open Source: Versions 1.0.0 through 1.30.1
• Fixed in: 1.30.2 and 1.31.1
• NGINX Plus: Version 37.0.0
• Fixed in: 37.0.1.1

Several NGINX-based products, including NGINX Ingress Controller, NGINX App Protect, and NGINX Gateway Fabric, are also affected by shared underlying components.

Notably, F5 products such as BIG-IP, BIG-IQ, and F5 Distributed Cloud services are not affected.

The vulnerability is triggered when rewrite rules use unnamed and overlapping capture groups. During request processing, improper memory handling results in out-of-bounds writes on the heap.

Example of vulnerable configuration:

• rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

Secure alternative using named captures:

• rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;

This change eliminates ambiguity and prevents unsafe memory operations.

Mitigation and Recommendations

Organizations are strongly advised to:

• Upgrade to patched versions immediately
• Audit rewrite rules for unsafe regex patterns
• Replace unnamed capture groups with named captures
• Enable exploit mitigations such as ASLR where possible
• Monitor logs for abnormal request patterns or repeated worker crashes

The vulnerability was responsibly disclosed by researchers Mufeed VH (Winfunc Research), Nebula Security, and Vexera AI.

Given NGINX’s widespread use in web infrastructure, prompt patching and configuration review are essential to prevent potential exploitation in the wild.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.