CVE-2026-9256

A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.

To mitigate this vulnerability, use named captures instead of unnamed captures in rewrite definitions.

For example, the following rewrite directive uses unnamed PCRE capture groups, $1 and $2:

rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last;

To mitigate this vulnerability for this example, replace $1 and $2 with the appropriate named captures, $user_id and $section:

rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last;