A heap buffer overflow occurs in the nginx core module when a location block uses the alias directive together with rewrite or set/return directives that reference the $request_filename variable, or when $request_filename is used in an access log format. Attacks can be launched from any client, and because the bug can be triggered remotely without authentication, it satisfies a network‑based attack vector. The overflow allows an attacker to corrupt the worker process memory, potentially causing a restart (denial of service) or, if address‑space layout randomization is disabled or can be bypassed, execution of arbitrary code on the server.

The vulnerability affects both NGINX Plus and NGINX Open Source components distributed by F5. No specific version ranges are provided, so any installation of either product that has not applied a related patch may be vulnerable.

With a CVSS score of 9.2 the issue is considered critical. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, but the high base score and the fact that the flaw is exploitable without prior authentication suggest it remains a significant threat. The vulnerability is not listed in CISA’s KEV catalog at this time, but the nature of the bug and its remote exploitation capability warrant immediate attention. Attackers must send crafted HTTP requests; no special privileges or exploitation of another component are required.