Summary
| Vulnerability Name | NGINX Buffer Overflow (CVE-2026-27654) |
| Released on | April 11, 2026 |
| Affected Component | NGINX |
| Affected Version | 0.5.13 ≤ NGINX Open Source < 1.28.3 1.29.0 ≤ NGINX Open Source < 1.29.7 R32 ≤ NGINX Plus < R32 P5 All versions of NGINX Plus R33 All versions of NGINX Plus R34 R35 ≤ NGINX Plus < R35 P2 R36 ≤ NGINX Plus < R36 P3 |
| Vulnerability Type | Buffer overflow |
| Exploitation Condition | 1. User authentication: not required. 2. Preconditions: - It is an NGINX location block matched using prefix matching, rather than a regular expression or exact match. - The configuration file has dav_methods enabled, and uses the COPY or MOVE method. - The alias directive is used within the current location to map to a local file directory. 3. Trigger mode: remote. |
| Impact | Exploitation difficulty: difficult. The exploitation can be successful only after the foregoing three preconditions are met. Severity: critical. This vulnerability may result in buffer overflow and arbitrary file read. |
| Official Solution | Available |
About the Vulnerability
Component Introduction
NGINX (pronounced "engine x") is an HTTP and reverse proxy server, a mail proxy server, and a general TCP/UDP proxy server originally written by Igor Sysoev.
Vulnerability Description
On April 11, 2026, Sangfor FarSight Labs received notification of the buffer overflow vulnerability in NGINX (CVE-2026-27654), classified as critical in threat level.
Specifically, the ngx_http_dav_module module in both NGINX Open Source and NGINX Plus contains a buffer overflow vulnerability. This vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system.
Affected Versions
The following NGINX versions are affected:
0.5.13 ≤ NGINX Open Source < 1.28.3
1.29.0 ≤ NGINX Open Source < 1.29.7
R32 ≤ NGINX Plus < R32 P5
All versions of NGINX Plus R33
All versions of NGINX Plus R34
R35 ≤ NGINX Plus < R35 P2
R36 ≤ NGINX Plus < R36 P3
Remediation Solutions
Official Solutions
The latest version has been officially released to fix the vulnerability. Affected users are advised to update NGINX to the latest version.
Temporary Solutions
1. Disable unused functional modules to reduce attack entry points.
2. Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
3. Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
4. Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.
Sangfor Solutions
Proactive Vulnerability Detection
The following Sangfor services can proactively detect CVE-2026-27654 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:
- Athena Managed Detection and Response (MDR): The corresponding detection solution will be released on May 30, 2026. The rule ID is SF-2026-01012.
- Athena Extended Detection and Response (XDR): The corresponding detection solution has been released. The rule ID is SF-2026-00873.
Timeline
On April 11, 2026, Sangfor FarSight Labs received notification of the buffer overflow vulnerability in NGINX (CVE-2026-27654).
On April 13, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
https://my.f5.com/manage/s/article/K000160382
Learn More
Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.
