Carlos Henrique Lima Melara

**Name of the Vulnerable Software and Affected Versions** NGINX Plus versions prior to 1.31.1 NGINX Open Source versions 0.1.17 through 1.31.0 **Description** A flaw in the `ngx http rewrite module` module occurs when a rewrite directive utilizes a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests, leading to a heap buffer overflow in the NGINX worker process. This may result in a denial of service by forcing the process to restart or allow arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. ASLR is a security technique that randomly arranges the address space positions of key data areas of a process to make exploitation more difficult. **Recommendations** Update NGINX Plus to version 1.31.1. Update NGINX Open Source to version 1.31.1 or 1.30.2. As a temporary mitigation, avoid using rewrite directives with overlapping PCRE captures in redirect or arguments contexts.