The flaw occurs when a map directive in NGINX uses regex matching and the root or access log format references the map’s regex capture variables before the map’s output variable is referenced. This triggers a heap buffer overflow in the worker process, causing a restart, and if Address Space Layout Randomization is disabled or can be bypassed, it may allow execution of arbitrary code. The vulnerability can be triggered by an unauthenticated attacker with crafted HTTP requests, leading to a denial of service or possible code execution.

The vulnerability affects both F5 NGINX Open Source and NGINX Plus. Specific version information is not provided, so any deployment of these products without an applied update may be impacted. End of Technical Support releases are excluded from the evaluation.

The CVSS score of 9.2 marks this flaw as critical. The EPSS score is 0.00554%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated and limited to the data plane, requiring only that the attacker send crafted requests. While the exploitation probability is low, the high severity and the possibility of code execution when ASLR is disabled make this a serious risk.