Riskcovery

CVE-2026-60005

NGINX ngx_http_slice_module vulnerability

State
Published
Severity
8.8 High
Published
Jul 15, 2026
Updated
Jul 15, 2026
Reserved
Jul 8, 2026

Read the record on cve.org

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSSScoreVectorSource
4.08.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:Nf5
3.18.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hf5

Weaknesses

  • CWE-908 Use of Uninitialized Resource

Affected Products

ProductVersions
NGINX PlusF5
  • 37.0.0.1 to before 37.0.3.1Affected
  • R36 to before R36 P7Affected
  • R33 and laterAffected
NGINX Open SourceF5
  • 1.31.2 to before 1.31.3Affected
  • 1.15.8 to before 1.30.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.