CVE-2026-60005 — NGINX ngx_http_slice_module vulnerability

Back Back to CVE browser

HIGH

NGINX ngx_http_slice_module vulnerability

Published Jul 15, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.53%

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Vendor F5 Product NGINX Open Source Default
unaffected
- Version
  1.15.8
  Status
  affected
  Constraints
  <1.30.4
- Version
  1.31.2
  Status
  affected
  Constraints
  <1.31.3
Vendor F5 Product NGINX Plus Default
affected
- Version
  37.0.0.1
  Status
  affected
  Constraints
  <37.0.3.1
- Version
  R33
  Status
  affected
  Constraints
  <*
- Version
  R36
  Status
  affected
  Constraints
  <R36 P7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NGINX Open Source

unaffected

Version	Status	Constraints
1.15.8	affected	<1.30.4
1.31.2	affected	<1.31.3

NGINX Plus

affected

Version	Status	Constraints
37.0.0.1	affected	<37.0.3.1
R33	affected	<*
R36	affected	<R36 P7

Red Hat Discovery 2

discovery/discovery-ui-rhel9:1788206196

Fixed · RHSA-2026:61783
Red Hat Enterprise Linux 10

nginx-2:1.26.3-6.el10_2.6

Fixed · RHSA-2026:59220
Red Hat Enterprise Linux 8

nginx:1.24-8100020260809162034.489197e6

Fixed · RHSA-2026:59216
Red Hat Enterprise Linux 9

nginx-2:1.20.1-28.el9_8.5

Fixed · RHSA-2026:59362
Red Hat Enterprise Linux 9

nginx:1.24-9080020260804072754.9

Fixed · RHSA-2026:59490
Red Hat Enterprise Linux 9

nginx:1.26-9080020260803214158.9

Fixed · RHSA-2026:59496
Red Hat Hardened Images

nginx-main-1.30.4-2.hum1

Fixed · RHSA-2026:46012
Red Hat Update Infrastructure 5

rhui5/cds-kubernetes-rhel9:1788880445

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/cds-rhel9:1788880464

Fixed · RHSA-2026:66018
Red Hat Update Infrastructure 5

rhui5/rhua-rhel9:1788880581

Fixed · RHSA-2026:66018
Red Hat Hardened Images

php

Not affected
Red Hat Lightspeed proxy 1

insights-proxy/insights-proxy-container-rhel9

Will not fix

Product	Package	State	Advisory
Red Hat Discovery 2	discovery/discovery-ui-rhel9:1788206196	Fixed	RHSA-2026:61783
Red Hat Enterprise Linux 10	nginx-2:1.26.3-6.el10_2.6	Fixed	RHSA-2026:59220
Red Hat Enterprise Linux 8	nginx:1.24-8100020260809162034.489197e6	Fixed	RHSA-2026:59216
Red Hat Enterprise Linux 9	nginx-2:1.20.1-28.el9_8.5	Fixed	RHSA-2026:59362
Red Hat Enterprise Linux 9	nginx:1.24-9080020260804072754.9	Fixed	RHSA-2026:59490
Red Hat Enterprise Linux 9	nginx:1.26-9080020260803214158.9	Fixed	RHSA-2026:59496
Red Hat Hardened Images	nginx-main-1.30.4-2.hum1	Fixed	RHSA-2026:46012
Red Hat Update Infrastructure 5	rhui5/cds-kubernetes-rhel9:1788880445	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/cds-rhel9:1788880464	Fixed	RHSA-2026:66018
Red Hat Update Infrastructure 5	rhui5/rhua-rhel9:1788880581	Fixed	RHSA-2026:66018
Red Hat Hardened Images	php	Not affected	n/a
Red Hat Lightspeed proxy 1	insights-proxy/insights-proxy-container-rhel9	Will not fix	n/a

Remediation

Red Hat statement

Important: This vulnerability in NGINX's `ngx_http_slice_module` could lead to memory disclosure or denial of service. The impact on Red Hat products is reduced because the `ngx_http_slice_module` is not enabled by default. Exploitation requires explicit configuration of the module with the `slice` directive and unnamed regex captures, or during a background cache update, limiting exposure in typical deployments.

Red Hat mitigation

To mitigate this issue, disable the ngx_http_slice_module entirely if it is not required. If the module must be used, avoid unnamed regex captures with the slice directive and explicitly disable proxy_cache_background_update. Reload or restart the NGINX service to apply these changes. Please note this may cause a brief service interruption.

Metrics

0.53% 0.00531

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00531

Score over time

Jul–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.53% (0.00531)	42.81th	v5 (v2026.06.15)
Jul 16, 2026	0.61% (0.00610)	45.17th	v5 (v2026.06.15)

Weaknesses (2)

CWE-824

CWE-908

References (5)

https://access.redhat.com/security/cve/CVE-2026-60005
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2500992
Issue Tracking
https://my.f5.com/manage/s/article/K000162100
vendor-advisorypatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-60005
https://www.cve.org/CVERecord?id=CVE-2026-60005

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-60005		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2500992		Issue Tracking
https://my.f5.com/manage/s/article/K000162100		vendor-advisorypatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-60005
https://www.cve.org/CVERecord?id=CVE-2026-60005