UpHeron
All vulnerabilities

Servers and applications

CVE-2026-9256

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An…

Severity
Critical 9.2
Published
22 May 2026
Last changed
25 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.30.2
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx_open_source
  • From 0.1.17 up to 0.9.7
  • From 1.0.0 before 1.30.2
  • Version 1.31.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-9256
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9256