CVE-2026-27654: F5 Nginx Plus Buffer Overflow Vulnerability

CVE-2026-27654 Overview

CVE-2026-27654 is a heap-based buffer overflow vulnerability affecting the ngx_http_dav_module module in NGINX Open Source and NGINX Plus. This vulnerability allows remote attackers to trigger a buffer overflow in the NGINX worker process, potentially resulting in worker process termination (denial of service) or unauthorized modification of source and destination file names outside the document root.

The vulnerability is exploitable when specific configuration conditions are met: the NGINX configuration must use the DAV module's MOVE or COPY methods in combination with prefix location (non-regular expression location configuration) and alias directives. While the integrity impact is somewhat constrained due to the NGINX worker process operating with low privileges, successful exploitation can still lead to service disruption and potential path traversal attacks.

Critical Impact

Remote attackers can crash NGINX worker processes causing denial of service or manipulate file operations to access files outside the intended document root, potentially leading to data integrity issues.

Affected Products

• F5 NGINX Open Source (multiple versions)
• F5 NGINX Plus R32 (P1 through P4)
• F5 NGINX Plus R33 (base and P1 through P3)
• F5 NGINX Plus R34 (base and P1 through P2)
• F5 NGINX Plus R35 (base and P1)
• F5 NGINX Plus R36 (base and P1 through P2)

Discovery Timeline

• 2026-03-24 - CVE-2026-27654 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-27654

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The flaw exists within the ngx_http_dav_module module, which provides WebDAV protocol support for NGINX servers. When processing MOVE or COPY requests, the module fails to properly validate buffer boundaries under specific configuration scenarios.

The vulnerability requires a particular configuration pattern to be exploitable: the use of prefix locations (as opposed to regular expression-based location blocks) combined with alias directives. When these conditions are met, an attacker can craft malicious WebDAV requests that cause the worker process to write beyond allocated buffer boundaries.

The impact manifests in two primary ways: first, the buffer overflow can cause the NGINX worker process to crash, resulting in service disruption; second, the overflow can allow manipulation of file path strings, enabling attackers to modify source or destination file names to reference locations outside the intended document root. This path manipulation could potentially be leveraged for unauthorized file access or modification, though the impact is limited by the worker process's restricted privileges.

Root Cause

The root cause is improper boundary checking in the ngx_http_dav_module when handling path transformations during MOVE and COPY operations. When alias directives are used with prefix locations, the module calculates buffer sizes based on incorrect assumptions about path length relationships. This leads to a heap-based buffer overflow when processing specially crafted request URIs that exploit the mismatch between the configured alias path and the actual request path length.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP WebDAV requests (MOVE or COPY methods) to a vulnerable NGINX server. The attack requires the target server to have a specific configuration pattern:

1. The ngx_http_dav_module must be enabled
2. The configuration must use MOVE or COPY methods
3. A prefix location block must be defined (not a regex-based location)
4. An alias directive must be used within that location

When these conditions are met, the attacker can craft requests with path values designed to trigger the buffer overflow during path resolution and file operation processing.

Detection Methods for CVE-2026-27654

Indicators of Compromise

• Unexpected NGINX worker process crashes or restarts, particularly when processing WebDAV requests
• Anomalous WebDAV MOVE or COPY requests with unusually long or malformed path components in server access logs
• Error log entries indicating memory corruption, segmentation faults, or buffer-related issues in worker processes
• Evidence of file operations occurring outside expected document root directories

Detection Strategies

• Monitor NGINX error logs for worker process crashes, particularly those involving ngx_http_dav_module or occurring during MOVE/COPY request processing
• Implement web application firewall (WAF) rules to inspect WebDAV requests for path traversal patterns or unusually long URI components
• Deploy SentinelOne Singularity platform for real-time detection of buffer overflow exploitation attempts and anomalous process behavior
• Configure intrusion detection systems to alert on excessive WebDAV request volumes or requests with suspicious path sequences

Monitoring Recommendations

• Enable detailed logging for the ngx_http_dav_module to capture all MOVE and COPY operations with full request details
• Set up alerting for NGINX worker process crashes or unexpected restarts using process monitoring tools
• Monitor for file system activity outside expected document root boundaries using file integrity monitoring solutions
• Implement centralized log aggregation to correlate WebDAV requests with process crashes across your NGINX infrastructure

How to Mitigate CVE-2026-27654

Immediate Actions Required

• Review NGINX configurations to identify instances using ngx_http_dav_module with MOVE or COPY methods, prefix locations, and alias directives
• Apply the security patch from F5 as documented in the vendor advisory for all affected NGINX deployments
• If immediate patching is not possible, consider disabling the DAV module or restricting MOVE/COPY methods as an interim measure
• Implement network-level access controls to limit WebDAV access to trusted clients only

Patch Information

F5 has released security patches addressing this vulnerability. Administrators should consult the F5 Technical Article K000160382 for detailed patch information, affected version specifics, and upgrade guidance. Organizations running NGINX Plus should upgrade to the latest patched release for their respective version branch. NGINX Open Source users should upgrade to the latest stable release that includes the security fix.

Workarounds

• Disable the ngx_http_dav_module entirely if WebDAV functionality is not required by removing or commenting out DAV-related directives
• Restrict MOVE and COPY methods to authenticated users only and limit access to trusted IP ranges
• Replace alias directives with root directives where architecturally feasible to avoid the vulnerable configuration pattern
• Implement a reverse proxy or WAF in front of NGINX to filter and validate WebDAV requests before they reach the vulnerable module

# Example: Restrict DAV methods to authenticated users only
# Add to relevant location blocks in nginx.conf

location /webdav/ {
    # Require authentication for DAV methods
    limit_except GET HEAD {
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;
        
        # Optional: Also restrict by IP
        allow 192.168.1.0/24;
        deny all;
    }
    
    # If DAV not needed, disable entirely:
    # dav_methods off;
}