A heap buffer overflow exists in the nginx rewrite module when a rewrite, if, or set directive is followed by an unnamed Perl-Compatible Regular Expression capture with a replacement string that includes a question mark. This is a classic example of CWE‑122 (Heap Buffer Overflow) caused by an improper calculation of buffer size (CWE‑131). An unauthenticated attacker, along with conditions beyond its control, can exploit this vulnerability by sending crafted HTTP requests to the affected server. The overflow may trigger a worker process restart, and if the system has Address Space Layout Randomization disabled, the vulnerability can be leveraged to achieve code execution at the worker process level.

The vulnerability affects F5’s NGINX Open Source and NGINX Plus distributions. No specific product versions are listed in the CNA data; affected releases are those containing the vulnerable rewrite module code path. The weakness is linked to the identified buffer overflow (CWE‑122) and improper buffer size calculation (CWE‑131) within the rewrite module.

The CVSS score of 9.2 classifies the flaw as critical. The EPSS score of 68% indicates a higher likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP request sent to the vulnerable server with a crafted rewrite directive that includes the described pattern. The vulnerability, identified as a buffer overflow (CWE‑122) caused by improper buffer size calculations (CWE‑131), is most likely exploited via this network‑based attack. Exploitation requires that the rewrite configuration includes the described pattern; if ASLR is disabled, the resulting buffer overflow can lead to arbitrary code execution.