NGINX Plus and NGINX Open Source contain a heap buffer overflow in the ngx_http_rewrite_module when a rewrite directive uses a regex pattern with overlapping captures and a replacement string that references multiple captures. An unauthenticated attacker can send crafted HTTP requests that trigger the overflow, causing the NGINX worker process to restart. If the system has Address Space Layout Randomization disabled or the attacker can bypass ASLR, the overflow can also be used to execute arbitrary code.

The vulnerability affects NGINX Open Source and NGINX Plus as provided by F5. No specific version information is listed, so all installations of these products potentially remain vulnerable unless newer releases contain a patch.

The CVSS score of 9.2 indicates high severity. While the EPS score is not available, the vulnerability can be exploited remotely without authentication by manipulating HTTP requests, and the lack of a KEV listing does not diminish the risk. If ASLR is disabled or evaded, remote code execution is possible, making the risk very high in environments that do not enforce memory protection.