Skip to content
VulniPulse
Sign in
Advisory severityHigh8.8F5 Updated

High [CVE-2026-60005] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module

This high-severity F5 advisory covers CVE-2026-60005 affecting NGINX Plus, NGINX Open Source.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-60005 Source published Source updated

VulniPulse record published Record updated

CVE-2026-60005
Affected products & platforms
F5NGINX
Open source advisory

Get an email when F5 publishes the next one.

VulniPulse checks F5's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

Summary

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.

When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process.

There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected versions
  • NGINX Plus 37.0.0.1 before 37.0.3.1
  • NGINX Plus R36 before R36 P7
  • NGINX Plus R33
  • NGINX Open Source 1.31.2 before 1.31.3
  • NGINX Open Source 1.15.8 before 1.30.4

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Fixed versions
  • 37.0.3.1
  • R36 P7
  • 1.31.3
  • 1.30.4

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Official advisory · high-confidence parse· fetched 4 months ago·verify at source

More F5 advisories

All F5 advisories

Android app · Google Play

Monitor future F5 CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alertsSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.