CVE-2026-60005

Executive Summary

CVE-2026-60005 is a high-severity vulnerability in NGINX Plus and NGINX Open Source, specifically within the ngx_http_slice_module module. This module, which is not enabled by default, is used for slicing large responses into smaller chunks for efficient caching and delivery. The vulnerability arises when the slice directive is configured alongside unnamed regex captures, or during a background cache update. An unauthenticated attacker can send specially crafted requests that trigger uninitialized memory access in the NGINX worker process. This can lead to limited disclosure of sensitive memory contents or cause the worker process to crash and restart, resulting in a denial of service (DoS). The CVSS score of 8.2 reflects the high availability impact and the network-based, low-complexity attack vector, though the confidentiality impact is limited. No public proof-of-concept (PoC) or exploit code is currently available, and no official patch has been released by NGINX.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a core NGINX software issue affecting both the open-source and commercial Plus versions. Organizations using NGINX as a reverse proxy or load balancer should assess their exposure, particularly if the ngx_http_slice_module is enabled.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited memory disclosure possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Worker process crash leading to DoS.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication. While the confidentiality impact is limited, the availability impact is severe, potentially causing service disruption. The lack of a patch and the specific configuration requirement (enabling the module) slightly reduce the immediate risk, but for affected deployments, the threat is critical.

Deep Dive & Mechanics

The ngx_http_slice_module is designed to split a large HTTP response into smaller, cacheable slices. It uses the slice directive to define the slice size and can utilize regex captures to extract slice identifiers from the request URI.

The vulnerability lies in the interaction between the slice directive and unnamed regex captures. When a request is processed, the module may attempt to access memory that has not been properly initialized. This can occur in two scenarios:

1. Unnamed Regex Captures: If the slice directive is configured with a regex pattern that includes unnamed capture groups (e.g., slice $slice_id where $slice_id is derived from an unnamed capture), the module may fail to properly initialize the memory location for the captured value. Subsequent access to this uninitialized memory can lead to reading arbitrary data from the worker process's memory space.

2. Background Cache Update: When a cached slice is being updated in the background, a race condition or improper state management can cause the module to access memory that has been freed or not yet allocated. This also results in uninitialized memory access.

The uninitialized memory access can have two primary effects:

• Memory Disclosure: The attacker may receive a response containing fragments of memory that were not intended to be exposed. This could include sensitive data such as other users' session tokens, internal configuration details, or other application data.
• Worker Process Crash: The access violation can cause the NGINX worker process to terminate unexpectedly. NGINX will typically spawn a new worker process, but this results in a temporary denial of service for all connections handled by that worker.

The vulnerability is classified as CWE-908 (Use of Uninitialized Memory). It is a data plane issue only, meaning it does not affect the control plane (management interfaces).

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison cannot be provided. However, based on the vulnerability description, the following hypothetical code snippets illustrate the issue.

Vulnerable Code (Conceptual):

// In ngx_http_slice_module.c
ngx_int_t ngx_http_slice_parse(ngx_http_request_t *r) {
    ngx_str_t slice_id;
    // Regex capture is performed but slice_id is not initialized if capture fails
    if (ngx_regex_exec(r->slice_regex, &r->uri, &slice_id) == NGX_OK) {
        // Use slice_id
    }
    // If regex fails, slice_id remains uninitialized
    // Later, slice_id is used without checking
    ngx_http_slice_set_header(r, &slice_id);
}

Patched Code (Hypothetical):

// In ngx_http_slice_module.c
ngx_int_t ngx_http_slice_parse(ngx_http_request_t *r) {
    ngx_str_t slice_id = ngx_null_string; // Initialize to empty
    if (ngx_regex_exec(r->slice_regex, &r->uri, &slice_id) == NGX_OK) {
        // Use slice_id
    } else {
        // Handle failure, e.g., return error or use default
        return NGX_ERROR;
    }
    // slice_id is now safe to use
    ngx_http_slice_set_header(r, &slice_id);
}

The fix would involve ensuring that all memory used for regex captures is properly initialized before any conditional logic, and that error paths do not leave variables in an uninitialized state.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• NGINX with ngx_http_slice_module enabled (compiled with --with-http_slice_module).
• Configuration using the slice directive with unnamed regex captures.

Lab Setup:

1. Install NGINX with the slice module:

   ./configure --with-http_slice_module
   make && make install
   

2. Configure NGINX to use slicing:

   location / {
       slice 1m;
       slice_header X-Slice-Id;
       proxy_pass http://backend;
       # Example regex with unnamed capture
       set $slice_id $1;
       if ($uri ~ "^/data/(.*)") {
           set $slice_id $1;
       }
   }
   

3. Start NGINX.

Exploitation Steps: Since no public exploit exists, the attack would involve fuzzing or crafting requests that trigger the uninitialized memory access. A potential approach:

• Send requests with URIs that match the regex pattern but with unexpected characters or lengths.
• Send concurrent requests to trigger race conditions during cache updates.
• Monitor NGINX error logs for crashes or unexpected behavior.

Expected Outcome:

• Worker process crash (DoS) or memory disclosure in the response body.

Blue Team (Defense & Detection)

Detection:

• Monitor NGINX error logs for segmentation faults or worker process crashes.
• Look for unusual response sizes or content that may indicate memory leakage.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Disable the ngx_http_slice_module if not required.
• Avoid using unnamed regex captures in the slice directive.
• Apply any vendor patches as soon as they become available.
• Implement Web Application Firewall (WAF) rules to filter suspicious requests.

Indicators of Compromise (IOCs)

• Log Entries:
  • NGINX error log entries containing "segfault", "SIGSEGV", or "worker process exited" without a clear reason.
  • Repeated worker process restarts in a short time frame.
• Network Traffic:
  • Requests with unusual URI patterns that match the slice regex but cause abnormal responses.
  • Responses containing unexpected binary data or fragments of memory (e.g., strings from other processes).
• System Indicators:
  • Core dumps from NGINX worker processes.
  • High CPU usage due to repeated worker restarts.

Detection Engineering

YARA Rule

rule CVE_2026_60005_NGINX_Slice_Memory_Corruption {
    meta:
        description = "Detects NGINX worker process crashes or memory corruption indicative of CVE-2026-60005"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-60005"
    strings:
        $segfault = "segfault" nocase
        $sigsegv = "SIGSEGV" nocase
        $worker_exit = "worker process exited" nocase
        $slice_error = "ngx_http_slice_module" nocase
    condition:
        any of ($segfault, $sigsegv, $worker_exit) and $slice_error
}

Sigma Rule

title: NGINX Worker Process Crash Due to CVE-2026-60005
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects NGINX worker process crashes potentially caused by exploitation of CVE-2026-60005
author: Valters IT
date: 2026-01-01
logsource:
    product: nginx
    service: error
detection:
    selection:
        - message: "*segfault*"
        - message: "*SIGSEGV*"
        - message: "*worker process exited*"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-60005 NGINX Slice Module Memory Corruption Attempt"; flow:to_server; content:"/"; http_uri; pcre:"/^\/data\/(.*)/"; reference:cve,2026-60005; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the ngx_http_slice_module if it is not essential for your use case. Recompile NGINX without the --with-http_slice_module flag.
   • If the module is required, avoid using unnamed regex captures in the slice directive. Use named captures instead (e.g., (?<slice_id>...)).

2. Short-Term Mitigation:

   • Implement a Web Application Firewall (WAF) to filter requests that match the vulnerable pattern.
   • Monitor NGINX logs for signs of exploitation and restart workers proactively.
   • Limit the number of worker processes to reduce the impact of a crash.

3. Long-Term Remediation:

   • Apply official patches from NGINX as soon as they are released.
   • Upgrade to a patched version of NGINX when available.
   • Conduct a thorough security review of all NGINX configurations, especially those using the slice module.

4. Compensating Controls:

   • Use a reverse proxy or load balancer in front of NGINX to filter malicious traffic.
   • Enable rate limiting to reduce the impact of DoS attacks.
   • Implement network segmentation to limit exposure of NGINX instances.

Valters IT
DevSecOps & Cyber Threat Intelligence