The vulnerability resides in the ngx_http_dav_module of NGINX Open Source and NGINX Plus, allowing a buffer overflow120, CWE-122) when the server processes HTTP MOVE or COPY requests that use a prefix-location configuration and an alias directive. This can cause the worker process to terminate or to access paths outside the document root. The worker runs with low privileges, so the ability to compromise the system as a whole is limited to files within or adjacent to the web directory, but the opportunity to disrupt service via a crash remains substantial.

All installations of NGINX Open Source and all versions of NGINX Plus that enable the DAV module and process MOVE or COPY methods with alias directives are affected. The advisory does not list specific patch versions, so any supported NGINX release that be vulnerable.

The CVSS score of 8.8 classifies this issue as high severity, and the EPSS score of 8% indicates a relatively high probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by issuing specially crafted HTTP MOVE or COPY requests; this inference is drawn from the description of the vulnerable configuration and the nature of web server interactions.