CVE-2026-93479 — NGINX map directive and regex matching vulnerability

A vulnerability affects NGINX Plus and NGINX Open Source when a map directive uses regular-expression matching and the map's regex capture variables are referenced before the map output variable. Under certain conditions, the same result may occur when a non-cacheable variable is used in a string expression. An unauthenticated attacker can send crafted HTTP requests to cause a heap-based buffer overflow in an NGINX worker process, leading to a restart. Code execution may additionally be possible under certain ASLR conditions. The issue affects the data plane, not the control plane.