The vulnerability resides in the ngx_http_dav_module of NGINX Open Source and NGINX Plus, allowing a buffer overflow when the server processes HTTP MOVE or COPY requests that use a prefix‑location configuration and an alias directive; this can terminate the worker process or cause the process to write to or read from paths outside the document root. The affected worker runs with low privileges, so the integrity impact is limited to files within or directly adjacent to the web directory, but the denial of service through worker process crashes remains a significant risk.

All installations of NGINX Open Source and all versions of NGINX Plus that enable the DAV module and process MOVE or COPY methods with alias directives are affected. No specific patch version numbers are listed in the advisory, so any NGINX version still supported should be examined for the vulnerable configuration.

The CVSS score of 8.8 classifies this as high severity. The EPSS score is less than 1%, indicating that automated exploitation is currently rare, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely exploitation requires an attacker who can send crafted HTTP requests to the target, which makes the attack vector remote over the network. The combination of high severity and low exploitation probability places the overall risk in a moderate‑to‑high range for exposed servers.