nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...

CVE-2026-60005

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

PT-2026-60206

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http slice module module. When the slice directive is used with unnamed regex captures or during a background cac...

CLSA-2026-1779367740 Fix CVE(s): CVE-2026-42945

SECURITY UPDATE: fix heap buffer overrun in ngxhttprewritemodule when rewrite is followed by set/if/rewrite with unnamed PCRE captures - debian/patches/CVE-2026-42945.patch: fix heap buffer overrun in ngxhttprewritemodule when rewrite is followed by set/if/rewrite with unnamed PCRE captures -...

CLSA-2026-1779126256 Fix CVE(s): CVE-2026-42945

SECURITY UPDATE: fix heap buffer overrun in ngxhttprewritemodule when rewrite is followed by set/if/rewrite with unnamed PCRE captures - debian/patches/CVE-2026-42945.patch: fix heap buffer overrun in ngxhttprewritemodule when rewrite is followed by set/if/rewrite with unnamed PCRE captures -...