CVE-2026-60005: NGINX Information Disclosure Vulnerability

CVE-2026-60005 Overview

CVE-2026-60005 is an uninitialized memory access vulnerability in the ngx_http_slice_module module of NGINX Plus and NGINX Open Source. The flaw is triggered when the slice directive is combined with unnamed regex captures, or when a background cache update occurs. Remote, unauthenticated attackers can send crafted HTTP requests that cause the NGINX worker process to read uninitialized memory. The condition leads to limited disclosure of process memory or a worker restart. The issue is data plane only and does not expose the control plane. The ngx_http_slice_module is not built by default and must be enabled at compile time with --with-http_slice_module.

Critical Impact
Unauthenticated remote attackers can trigger uninitialized memory access in the NGINX worker, resulting in memory disclosure or worker restart against internet-facing HTTP endpoints.

Affected Products

NGINX Plus (versions compiled with ngx_http_slice_module)
NGINX Open Source (versions compiled with --with-http_slice_module)
Configurations using the slice directive with unnamed regex captures or background cache updates

Discovery Timeline

2026-07-15 - CVE-2026-60005 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60005

Vulnerability Analysis

The vulnerability is classified as Uninitialized Memory Use [CWE-908]. The ngx_http_slice_module splits large responses into byte-range subrequests to improve caching efficiency for large files. When the module interacts with unnamed regex captures in the NGINX configuration, or when a background cache update is in flight, memory buffers used by the worker are read before being fully initialized. An attacker sending a specific sequence of HTTP requests can force the worker to operate on this uninitialized data. The result is either partial disclosure of memory contents in the response or a worker crash that triggers a restart. The attack requires no authentication and no user interaction over the network.

Root Cause

The root cause is missing initialization of memory structures within the slice module code path when specific configuration constructs are present. Unnamed regex captures and background cache refresh paths were not accounted for in the initialization logic, leaving allocated buffers in an indeterminate state at read time.

Attack Vector

Exploitation occurs over the network against any HTTP endpoint served by an NGINX instance built with the slice module and configured with the vulnerable directive combinations. The attacker issues HTTP range or cache-triggering requests to reach the affected code path. No credentials, tokens, or user interaction are required. Refer to the F5 Security Article K000162100 for the vendor's technical description.

No public proof-of-concept code is available at the time of publication, and detailed exploitation code has not been released. The vulnerability mechanism is described in the vendor advisory linked above.

Detection Methods for CVE-2026-60005

Indicators of Compromise

Unexpected NGINX worker process restarts logged in error.log with signals such as SIGSEGV or worker process exited on signal 11.
Anomalous HTTP responses containing binary or non-content data returned for range requests against cached large objects.
Bursts of Range header requests targeting endpoints served by the slice module from a single or small set of source IPs.

Detection Strategies

Audit NGINX build configurations for the --with-http_slice_module flag and inspect nginx.conf for slice directives combined with unnamed regex captures in location blocks.
Correlate worker crash events with inbound HTTP request patterns, focusing on requests using Range headers and cache-refresh conditions.
Deploy web application firewall rules to flag high-volume Range-based requests to slice-enabled endpoints.

Monitoring Recommendations

Monitor NGINX error.log for worker process restarts and signal-related termination messages.
Enable and centralize access log collection with response size anomalies flagged for review.
Track process metrics for the NGINX worker pool, alerting on unexpected respawn frequency.

How to Mitigate CVE-2026-60005

Immediate Actions Required

Identify all NGINX Plus and NGINX Open Source deployments compiled with the ngx_http_slice_module module.
Review nginx.conf for use of the slice directive alongside unnamed regex captures and for proxy_cache_background_update configurations.
Apply the vendor-supplied fix as documented in the F5 Security Article K000162100 once available for your version.
Restrict exposure of affected endpoints behind authenticated reverse proxies or WAF policies until patching is complete.

Patch Information

Refer to the F5 Security Article K000162100 for fixed version information and vendor guidance. Software versions that have reached End of Technical Support (EoTS) are not evaluated and should be upgraded to a supported release.

Workarounds

Replace unnamed regex captures with named captures in location blocks that use the slice directive.
Disable background cache updates by removing or setting proxy_cache_background_update off; in affected server blocks.
Rebuild NGINX without --with-http_slice_module if the slice functionality is not required.

bash

# Configuration example: convert unnamed regex captures to named captures
# Vulnerable pattern (unnamed capture with slice)
# location ~ ^/media/(.+)$ {
#     slice 1m;
#     proxy_cache_key $uri$is_args$args$slice_range;
#     proxy_pass http://backend;
# }

# Safer pattern (named capture)
location ~ ^/media/(?<asset>.+)$ {
    slice 1m;
    proxy_cache_key $uri$is_args$args$slice_range;
    proxy_cache_background_update off;
    proxy_pass http://backend;
}