nginx map directive regex-capture heap buffer overflow in worker
A heap buffer overflow in the nginx worker process when a map directive's string expression references its regex capture variables before the output variable. Reachable via crafted HTTP; DoS by worker restart, code execution possible only where ASLR is disabled or bypassable.
- Vendor
- F5
- Product
- nginx (open source), NGINX Plus
- CVSS
- 8.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Fixed builds: nginx 1.30.4 (stable branch), nginx 1.31.3 (mainline branch), and NGINX Plus 37.0.3.1. Anyone on an earlier build should upgrade.
The vulnerability exists when a map directive uses regex matching and a string expression references the map’s regex capture variables before the map output variable — or, per NVD, when a non-cacheable variable is used in a string expression under certain conditions. An unauthenticated remote attacker who can reach the listener and whose request lands against a config carrying that shape can trigger a heap buffer overflow in the worker process, forcing a restart (denial of service) and, on systems where address-space layout randomization is disabled or can be bypassed, potentially executing code. Control plane is not exposed; this is a data-plane issue only.
Per the NVD entry, builds that have reached End of Technical Support are not evaluated by this advisory. Interim mitigation, if patching is delayed: audit map blocks for string expressions that reference regex capture variables before the map output variable, and restructure or remove them.
