A heap buffer overflow exists in the nginx rewrite module when a rewrite, if, or set directive is followed by an unnamed Perl-Compatible Regular Expression capture with a replacement string that includes a question mark. An unauthenticated attacker, along with conditions beyond its control, can exploit this vulnerability by sending crafted HTTP requests to the affected server. The overflow may trigger a worker process restart, and if the system has Address Space Layout Randomization disabled, the vulnerability can be leveraged to achieve code execution at the worker process level.

The vulnerability affects F5’s NGINX Open Source and NGINX Plus distributions. No specific product versions are listed in the CNA data; affected releases are those containing the vulnerable rewrite module code path.

The CVSS score of 9.2 classifies the flaw as critical. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network‑based, unauthenticated HTTP request that triggers the vulnerable rewrite logic. Exploitation requires that the rewrite configuration includes the described pattern; if ASLR is disabled, the resulting buffer overflow can lead to arbitrary code execution.