CVE-2026-93479: NGINX Plus 37.1.0 to before 37.1.0.1, 37.0.0 to before 37.0.5.1, R36 to before *, R35 to before *, R34 to before *…

Affected technology

NGINX Plus · 37.1.0 to before 37.1.0.1, 37.0.0 to before 37.0.5.1, R36 to before *, R35 to before *, R34 to before *, R33 to before *
F5

NGINX Open Source · 1.31.2 to before 1.31.7, 1.30.0 to before 1.30.6
F5

Component: The map directive with regex matching

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality, integrity and availability impact as high.