CVE-2026-60005: 
NGINX vulnerability analysis and mitigation

CVE-2026-60005 is a use of uninitialized resource vulnerability (CWE-908) in the ngx_http_slice_module module of NGINX Plus and NGINX Open Source. When the slice directive and unnamed regex captures are configured, or when a background cache update occurs, unauthenticated remote attackers can send crafted requests that trigger uninitialized memory access in the NGINX worker process, leading to limited memory disclosure or a worker process restart. Affected versions include NGINX Open Source 1.15.8 through 1.30.3 and 1.31.2, and NGINX Plus R33 through R36 (before R36 P7) and 37.0.0.1 through 37.0.3.0. The vulnerability was published on July 15, 2026, with patches available the same day. It carries a CVSS v3.1 score of 8.2 (High) and a CVSS v4.0 score of 8.8 (High) (GitHub Advisory, F5 Advisory).

The root cause is CWE-908 (Use of Uninitialized Resource): the ngx_http_slice_module fails to properly initialize memory under two specific conditions — when the slice directive is used alongside unnamed regex captures in location matching, or when a background cache update is triggered. In these scenarios, the NGINX worker process may access uninitialized memory regions, which can be partially exposed to the attacker or cause the worker to crash and restart. The attack requires no authentication, no user interaction, and no special privileges; however, exploitation is only possible if the ngx_http_slice_module is compiled into NGINX (via --with-http_slice_module) and the relevant configuration is active, as the module is not enabled by default. No public proof-of-concept exploit code has been identified (GitHub Advisory, F5 Advisory).

Successful exploitation allows a remote, unauthenticated attacker to achieve limited disclosure of NGINX worker process memory contents — potentially exposing sensitive in-memory data such as cached responses, headers, or other process memory — and/or cause a denial of service by forcing the worker process to restart. The impact is confined to the data plane; there is no control plane exposure. Integrity is not affected, and lateral movement potential is limited, though memory leakage could theoretically expose credentials or session tokens held in worker memory (GitHub Advisory, F5 Advisory).

1. Reconnaissance: Identify NGINX instances compiled with --with-http_slice_module by probing HTTP responses for slice-related headers (e.g., Content-Range) or by reviewing exposed configuration files. Tools like Shodan or Censys can help locate internet-facing NGINX servers.
2. Confirm configuration: Determine whether the target uses the slice directive alongside unnamed regex captures in location blocks, or whether background cache updates are enabled — both are required trigger conditions.
3. Craft malicious request: Send specially crafted HTTP requests (e.g., range requests or cache-triggering requests) to the vulnerable endpoint to trigger the uninitialized memory access path within the ngx_http_slice_module.
4. Observe response: Analyze HTTP responses for leaked memory contents, or monitor for worker process restarts (e.g., via connection resets or error responses) as evidence of successful exploitation.
5. Repeat for memory disclosure: Iterate requests to maximize the amount of worker process memory disclosed, potentially recovering sensitive in-memory data (GitHub Advisory, F5 Advisory).

• Network: Unusual volume of HTTP range requests or cache-related requests to NGINX endpoints; repeated requests that result in partial content (206) or error responses from the same source IP.
• Logs: NGINX error logs showing worker process restarts (worker process exited on signal); access logs with repeated requests to slice-configured locations from a single IP with varying range headers.
• Process: Unexpected NGINX worker process restarts visible in system logs (/var/log/syslog, journalctl) or process monitoring; NGINX master process spawning new workers at an abnormal rate.
• File System: No specific file artifacts expected, but review NGINX configuration files for presence of slice directive combined with unnamed regex captures in location blocks as an indicator of a vulnerable configuration.

F5 has released patched versions: NGINX Open Source 1.30.4 and 1.31.3, and NGINX Plus R36 P7 and 37.0.3.1. Organizations should upgrade to these versions immediately. As a workaround, if the ngx_http_slice_module is not required, recompile NGINX without the --with-http_slice_module configuration parameter to eliminate the attack surface entirely. Additionally, implementing network access controls (e.g., firewall rules, WAF policies) to restrict who can send requests to NGINX can reduce exposure. NGINX Plus versions R33 and earlier that have reached End of Technical Support are not evaluated and should be upgraded (F5 Advisory, GitHub Advisory).

The vulnerability was covered by multiple security news outlets including CyberSecurityNews, GBHackers, and CyberPress, often in the context of a broader set of NGINX vulnerabilities patched simultaneously (including CVE-2026-42533 and CVE-2026-56434). Coverage emphasized F5's prompt patching and the risk to internet-facing NGINX deployments. Beazley Security published an advisory (BSL-A1192) covering the trio of NGINX memory corruption vulnerabilities. The Hacker News included the vulnerability in its weekly security recap. Social media discussion on Mastodon and Infosec.exchange noted the patch release, with community sentiment generally characterizing the risk as moderate given the non-default module requirement (CyberSecurityNews, Beazley Advisory).