critical CVSS 9 EPSS 0.53%

CVE-2026-60005·Nginx vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
critical
Software
Nginx
Fixed in
1.22.1-9+deb12u10
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.53% — higher than 44% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-60005 scores 9 on CVSS, so a successful attack would be serious — but at 0.53%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 1.22.1-9+deb12u10

Fixed in: 1.22.1-9+deb12u10

How to fix this CVE

Update Nginx to version 1.22.1-9+deb12u10 or later to patch the uninitialized memory access vulnerability in the ngx_http_slice_module. This module is only vulnerable if explicitly enabled during compilation with the --with-http_slice_module parameter. Immediately apply security updates to all Nginx instances, especially those configured with the slice directive or background cache updates.

sudo dnf update nginx

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET|HEAD|PUT|DELETE request to any URI triggering slice directive processing; worker process crash or sudden restart correlating with HTTP requests; segmentation faults in error.log mentioning ngx_http_slice_module or slice_range

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Disable or block HTTP requests that trigger the slice directive by implementing strict request filtering rules that prevent requests from reaching the slice module handler. Alternatively, disable the slice module entirely at the Nginx configuration level by commenting out all 'slice' directives until patching is complete.

How to check if you are affected

  1. Check installed Nginx version: nginx -v
  2. Verify if ngx_http_slice_module is compiled in: nginx -V | grep slice
  3. If slice module is present, check nginx.conf for 'slice' directive: grep -r 'slice' /etc/nginx/
  4. Review Nginx error logs for worker process crashes or segmentation faults: tail -100 /var/log/nginx/error.log | grep -i 'segfault\|signal'
  5. Confirm the patch was applied by running nginx -v again and comparing with version 1.22.1-9+deb12u10 or later

FAQ

What is CVE-2026-60005?

This vulnerability allows remote attackers to trigger uninitialized memory access in Nginx worker processes through crafted requests when the ngx_http_slice_module is enabled and configured with the slice directive or background cache updates, potentially leaking sensitive memory contents or causing worker restarts.

Is CVE-2026-60005 being actively exploited?

No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits have been disclosed.

What versions of Nginx are affected by CVE-2026-60005?

All versions up to and including 1.22.1-9+deb12u10 (and equivalent versions across distributions) are affected if compiled with the ngx_http_slice_module enabled.

How do I check if my server is vulnerable to CVE-2026-60005?

Run 'nginx -V | grep slice' to confirm the module is compiled in, then check for the slice directive in your nginx.conf with 'grep -r slice /etc/nginx/'. If both are present, your server is vulnerable unless already patched.

Is the ngx_http_slice_module enabled by default?

No, the ngx_http_slice_module is not enabled by default and only becomes a risk factor if explicitly compiled with the --with-http_slice_module configuration parameter during Nginx build time.

Does Defensia detect CVE-2026-60005?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Nginx is installed on a monitored server, CVE-2026-60005 will appear in your dashboard with remediation steps.

Related Nginx CVEs

CVE-2009-3555CVSS 10The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
CVE-2021-23017CVSS 9A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
CVE-2023-44487CVSS 9The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2026-42946CVSS 9A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-49975CVSS 9Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60005. Free for 1 server.

Get started free