SECUFOCUSNOW
Home›CVE index›CVE-2026-27654
Priority reviewHigh

CVE-2026-27654

F5 NGINX Open Source, NGINX Plus, Red Hat Enterprise Linux 10

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker proce...

CVSS
8.8
EPSS
21.7%
97.4% percentile
CISA KEV
Not listed
Published
2026.03.25
PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV
Exploit probability21.7%
Technical severityCVSS 8.8

Vulnerability overview

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker proce...

Affected product and versions

Product
F5 NGINX Open Source, NGINX Plus, Red Hat Enterprise Linux 10
Affected versions
>= 1.29.0 < 1.29.7, >= 0.5.13 < 1.28.3, >= R36 < R36 P3, >= R35 < R35 P2, >= R34, >= R33, >= R32 < R32 P5, r32, r33, r34, r35, r36, >= 0.5.13 <= 0.9.7, >= 1.0.0 < 1.28.3
Fixed versions
1.28.3, 1.29.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that F5 NGINX Open Source, NGINX Plus, Red Hat Enterprise Linux 10 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-120, CWE-122