Loading story…
Researchers disclosed CVE-2026-27654, a heap buffer overflow in NGINX's ngx_http_dav_copy_move_handler() that affects deployments compiled with ngx_http_dav_module and configured with alias alongside WebDAV COPY or MOVE methods. The bug stems from an unsigned underflow in ngx_http_map_uri_to_path() when a Destination header is shorter than the location prefix, allowing WebDAV root escape and arbitrary file read or write within the worker process's filesystem permissions. Calif.io said it developed multiple proof-of-concept exploits with AI assistance, including variants that could copy sensitive files such as /etc/passwd into attacker-accessible locations and write files through PUT and COPY, while noting that human researchers were needed to turn the initial AI-generated crash into a practical exploit chain.
F5 and the NGINX security team were notified in March and released a fix in NGINX 1.29.7 with advisory K000160382, while Calif later published PoC materials on GitHub describing the work as AI-generated and human-verified. Separately, Nebula Security reported a distinct NGINX zero-day dubbed nginx-poolslip, describing remote code execution in dynamic variable parsing paths affecting NGINX 1.31.0 and claiming its autonomous AI agent discovered the flaw; the report said technical details were initially withheld during disclosure and that NGINX 1.31.1 was later released as the patch. Together, the disclosures underscore a rapid cycle in which AI-assisted research is producing crash reproduction, exploit development, and fresh vulnerability claims against widely deployed NGINX code.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
According to the report, NGINX later released version 1.31.1 to patch the nginx-poolslip vulnerability. The issue was described as affecting both NGINX Open Source and NGINX Plus because they share the same core codebase.
Nebula Security disclosed an NGINX remote code execution zero-day dubbed nginx-poolslip, reportedly affecting NGINX 1.31.0. The company said no CVE had yet been assigned and that technical details were being withheld during a 30-day responsible disclosure window while F5 worked on a fix.
The Calif GitHub repository for CVE-2026-27654 was updated with a human-written blog post and README refresh. The repository continued to present the PoCs as AI-generated and human-verified.
Calif.io published a detailed analysis of CVE-2026-27654 describing multiple proof-of-concept exploits, including arbitrary file write and more practical arbitrary file read variants. The associated repository indicates the PoC directories were added the same day.
On the same day the fix became public, an AI-powered commit watcher independently derived a crashing proof of concept from the patch commit. The writeup cites this as evidence that AI is shrinking the time between patch release and exploit reproduction.
F5/NGINX released nginx 1.29.7 and advisory K000160382 to address CVE-2026-27654. The fix closed the heap buffer overflow in ngx_http_dav_copy_move_handler() caused by an unsigned underflow in ngx_http_map_uri_to_path().
Calif.io researchers reported a heap buffer overflow in nginx's WebDAV COPY/MOVE handling to F5 and the NGINX security team. The flaw affected configurations using ngx_http_dav_module with alias and could enable WebDAV root escape for arbitrary file read or write within worker process permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcegithub.com
Open sourceblog.calif.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 and NGINX disclosed **CVE-2026-42945** ("**NGINX Rift**"), a critical heap buffer overflow in `ngx_http_rewrite_module` affecting **NGINX Open Source 0.6.27 through 1.30.0** and **NGINX Plus R32 through R36**. The bug is exposed when servers use a specific rewrite pattern: a `rewrite` directive with unnamed PCRE captures such as `$1` or `$2`, a replacement string containing `?`, and a following `rewrite`, `if`, or `set` directive. An unauthenticated attacker can send crafted HTTP requests to corrupt heap memory in the worker process, reliably causing crashes and restarts; code execution is considered possible in weaker environments, particularly where **ASLR is disabled**. Fixes were released in **NGINX 1.30.1**, **1.31.0**, and patched NGINX Plus builds, while Debian, AlmaLinux, and other downstream vendors began shipping updates. Public writeups and proof-of-concept code quickly drove attacker interest, and multiple reports said **VulnCheck observed exploitation attempts on canary systems** within days of disclosure. Researchers and defenders broadly agreed that denial-of-service is the most practical near-term impact, while widespread reliable RCE is less likely on hardened systems with modern memory protections enabled. Administrators were urged to patch internet-facing reverse proxies, load balancers, ingress controllers, and API gateways, audit rewrite rules for unnamed captures, and use named captures as a temporary mitigation where upgrades cannot be applied immediately. The same release cycle also addressed additional NGINX flaws including **CVE-2026-42946**, **CVE-2026-40701**, and **CVE-2026-42934**.
Jun 29, 2026
NGINX released versions **1.31.1** and **1.30.2** to fix **CVE-2026-9256**, a heap buffer overflow in `ngx_http_rewrite_module` that can be triggered by unauthenticated attackers with specially crafted HTTP requests. The flaw affects **NGINX Open Source** and **NGINX Plus** when `rewrite` directives use overlapping or nested PCRE capture groups and replacement strings that reference multiple captures in redirect or arguments contexts, creating memory corruption in the worker process. Successful exploitation can force worker restarts and denial of service, and may lead to arbitrary code execution if protections such as ASLR are absent or bypassed; NGINX described the issue as a **data plane** exposure with no control plane impact.
Jun 29, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jun 29, 2026