The vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module can cause uncontrolled memory allocation or an over-read of data. An unauthenticated attacker capable of performing a man‑in‑the‑middle attack on the upstream server can send crafted responses that lead to an excessive memory request or read beyond the intended buffer, thereby allowing the attacker to read sensitive memory or trigger a worker process restart. The weakness is represented by CWE‑789 and CWE‑823.

Both NGINX Open Source and NGINX Plus are affected. No specific version numbers are listed in the advisory; therefore any NGINX build that includes these modules and has not been discontinued by end‑of‑technical‑support is potentially vulnerable.

The CVSS score of 8.3 indicates high severity. While EPSS data is not available, the lack of KEV listing suggests no known widespread exploitation yet. The likely attack vector requires an attacker to control upstream responses, typically via a compromised or malicious upstream service, which can be achieved through network or supply‑chain controls. Once the exploit is exercised, the attacker could read the worker process memory or force a restart, impacting confidentiality, integrity, and availability.