CVE-2026-60005: NGINX ngx_http_slice_module vulnerability

High 8.8 EPSS 0.7% nginx

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-60005CVE identifier
8.8CVSS 4.0 base score (high)
0.7%EPSS: chance of exploitation in the next 30 days (higher than 55% of CVEs)
2026-07-15published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run nginx and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
sudo systemctl restart nginx (a reload does not replace the master binary)

Affected and fixed versions

Affected:

F5 NGINX Plus 37.0.0.1 to before 37.0.3.1
F5 NGINX Plus R36 to before R36 P7
F5 NGINX Plus R33
F5 NGINX Open Source 1.31.2 to before 1.31.3
F5 NGINX Open Source 1.15.8 to before 1.30.4

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

sudo apt update
sudo apt install --only-upgrade nginx (nginx-core/-light/-full on older releases)

Ubuntu

sudo apt update
sudo apt install --only-upgrade nginx

RHEL, AlmaLinux, Rocky, Oracle

sudo dnf upgrade --refresh nginx nginx-core

Fedora

sudo dnf upgrade --refresh nginx nginx-core

SUSE / openSUSE

sudo zypper refresh
sudo zypper update nginx

Amazon Linux

sudo dnf upgrade --releasever=latest nginx nginx-core

Arch Linux

sudo pacman -Syu

Alpine

apk update && apk upgrade nginx

FreeBSD

pkg update && pkg upgrade nginx (or nginx-full)

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

Release	Package	Status	Fixed version / advisory
Debian 12	`nginx`	fixed	`1.22.1-9+deb12u10`
Debian 13	`nginx`	fixed	`1.26.3-3+deb13u8`
Debian testing	`nginx`	fixed	`1.30.1-7`
Red Hat Enterprise Linux 9	`nginx-2:1.20.1-28.el9_8.5`	fixed	`RHSA-2026:59362`
Red Hat Enterprise Linux 9	`nginx:1.24-9080020260804072754.9`	fixed	`RHSA-2026:59490`
Red Hat Enterprise Linux 9	`nginx:1.26-9080020260803214158.9`	fixed	`RHSA-2026:59496`
Red Hat Enterprise Linux 8	`nginx:1.24-8100020260809162034.489197e6`	fixed	`RHSA-2026:59216`
Red Hat Enterprise Linux 10	`nginx-2:1.26.3-6.el10_2.6`	fixed	`RHSA-2026:59220`

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.