CVE-2026-93479: NGINX Map Directive and Regex Matching Vulnerability
Summary
CVE-2026-93479: NGINX map directive and regex matching vulnerability. Affects nginx across 2 version ranges.
>= 1.30.0, < 1.30.6
>= 1.31.2, < 1.31.7
Fixed in 1.30.6 or 1.31.7, depending on the release line you run. How to fix ↓
Also tracked for
- nginx-gateway · Bitnami
The same CVE-2026-93479 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NGINX is a high-performance web server and reverse proxy server known for its stability, rich feature set, and low resource consumption. It is widely used for serving static content, load balancing, and as a reverse proxy for various applications. However, certain configurations, particularly involving the map directive and regex matching, can expose NGINX to vulnerabilities, such as the one described here.
Vulnerability Detail
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. This can lead to a heap buffer overflow in the NGINX worker process, potentially causing a denial-of-service (DoS) or allowing code execution on systems with Address Space Layout Randomization (ASLR) disabled. Attackers can exploit this vulnerability by sending crafted HTTP requests under specific conditions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.30.0, < 1.30.61.30.6 -
>= 1.31.2, < 1.31.71.31.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using regex capture variables in the map directive before referencing the map output variable. Review your NGINX configuration files to ensure compliance with this guideline.
Conclusion
CVE-2026-93479 represents a significant vulnerability in NGINX that can lead to severe consequences if not addressed. It is crucial for users to update to the latest versions or implement workarounds to mitigate the risk. Regular monitoring and vulnerability management, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for nginx →
FAQ
CVE-2026-93479 is a vulnerability in NGINX that can lead to a heap buffer overflow, potentially allowing remote code execution or denial-of-service.
Affected versions include NGINX versions prior to 1.30.6 and 1.31.7.
You can check your NGINX version using the command 'nginx -v'. If it is below the patched versions, it is vulnerable.
If an immediate update is not possible, review your NGINX configuration to avoid using regex capture variables before map output variables as a temporary workaround.
Vulert monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
