NGINX map directive use-after-free and buffer overflow
Use-after-free and buffer overflow in the NGINX map directive, triggered by unnamed regex captures. Affects any NGINX configuration using unnamed captures in map blocks.
- Vendor
- F5
- Product
- NGINX (Plus, Open Source, Ingress Controller, Gateway Fabric, Instance Manager)
- CVSS
- 8.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-93479 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-93479 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-20 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
CVE-2026-93479 is a use-after-free and buffer overflow in the NGINX map directive. The vulnerability is triggered by configurations using unnamed regex captures in map blocks, a pattern that appears in a wide range of production NGINX deployments for routing and URL rewriting.
F5 released an out-of-band patch on October 19, 2026. The affected product lineup matches the other two CVEs in this advisory cycle: NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager.
Mitigation before patching: Replace unnamed regex captures with named captures in any map configuration blocks. F5 recommends limiting map usage to named captures going forward.
NVD rates this CVSS 8.1 (high). No active exploitation has been reported. Unlike the two HTTP/3 module flaws in this same advisory release (CVE-2026-15176, CVE-2026-97205), this flaw is unrelated to the HTTP/3 stack.
Other F5 CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-97205 NGINX HTTP/3 use-after-free in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | — | — |
| CVE-2026-15176 NGINX HTTP/3 heap buffer overflow in ngx_http_v3_modulewrite-up | [ HIGH ] | 8.1 | — | — |
| CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 2.2% | |
| CVE-2026-42533 nginx map directive regex-capture heap buffer overflow in workerwrite-up | [ HIGH ] | 8.1 | 0.9% | — |
| CVE-2025-53521 F5 BIG-IP Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 2.3% | |
| CVE-2023-46748 F5 BIG-IP Configuration Utility SQL Injection Vulnerability | [ HIGH ] | 8.8 | 4.5% | |
| CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 96.5% | |
| CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypassransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
