One byte in nginx, and why 90 days is too long

Wed, 14 Oct 2026 09:00:00 -0700

In short

F5 published K000162607 today for CVE-2026-93479, a heap buffer overflow in nginx’s script engine. We reported it on July 25. Fixed in nginx 1.31.7 and 1.30.6.
It is a one-byte NUL write past a heap allocation, reachable without authentication through the access_log path in both HTTP and Stream. In Stream, a bare TLS ClientHello is enough.
It is an incomplete-fix variant of CVE-2026-42533, the “major” map and regex overflow patched in June. The hardening capped copies at the end of the buffer, but the end of the buffer included the caller’s NUL reserve.
nginx wrote the fix in four days. The advisory shipped 81 days after our report. The advisory credits a second researcher, so the bug was found at least twice while it sat in the queue.
Vulnerability discovery now runs at machine speed. Disclosure and patching still run at calendar speed. The second part of this post is about closing that gap.

Part 1: the bug

nginx evaluates variable-bearing strings, including the access_log file path, with a two-pass script engine. Pass one runs length codes and adds up how many bytes the result needs. Pass two runs copy codes and writes the bytes into a buffer sized exactly by pass one. The caller asks for one extra byte on top, the len argument, so it can append a NUL terminator.

Cve on Tolmo

One byte in nginx, and why 90 days is too long

In short

Part 1: the bug