Zero Radar
← feed
HighVulnerabilityCVE-2026-93479updated 26 Oct 2026, 17:26 UTC

nginx web server: buffer overflow when evaluating string expressions

A flaw in the nginx web server could let an attacker crash it or possibly run their own code on it. It is part of a group of nginx fixes released together.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdated nginx packages published in Debian DSA-6575-1 and Ubuntu USN-8955-1. Specific fixed version numbers not stated in the material. · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted HTTP or stream requests
  2. 2Request reaches nginxRequest hits an affected configuration
  3. 3String expression evaluatedVariable paths or regex map evaluated
  4. 4Buffer overflowReserved buffer space overwritten
  5. 5Crash or code runDenial of service or arbitrary code
  6. ResultAttacker may crash or control the nginx server

What happened

Evaluation of string expressions in nginx's HTTP and stream modules can overwrite reserved buffer space, causing a buffer overflow. Affected operations include variable document roots and access log paths; Ubuntu describes the related trigger as map directives using regex matching.

Why it is dangerous: A remote attacker could possibly crash nginx, causing a denial of service, or execute arbitrary code. Servers that use the affected configurations are most at risk, especially those exposed to the internet.

Are you affected?

You are affected if you run nginx with variable document roots, variable access log paths, or map directives using regex matching, as shown in the Debian and Ubuntu advisories.

nginx packages in Debian trixie (affected code introduced by an earlier security backport) and affected nginx packages in supported Ubuntu releases. Exact versions not stated in the material.

What to do

  1. Update nginx using your distribution's security update (Debian DSA-6575-1 or Ubuntu USN-8955-1)
  2. Restart nginx after the update so the fixed code is running
  3. Review configurations that use variable document roots, variable log paths, or regex map directives

Timeline

  1. 21 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 21 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA
  3. 26 Oct 2026, 17:26 UTC
    Ubuntu Security reported on it · Ubuntu Security

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-93479
EPSS
1.2% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 17:26 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

nginx web server: buffer overflow when evaluating string expressions · Zero Radar