CVE-2026-27654

Name of the Vulnerable Software and Affected Versions NGINX Open Source (affected versions not specified) NGINX Plus (affected versions not specified)

Description A heap-based buffer overflow exists in the ngx http dav module module. This issue occurs when the configuration utilizes the DAV module MOVE or COPY methods in combination with prefix location (non-regular expression location configuration) and alias directives. A remote attacker can exploit this by sending a short Destination header, which may lead to the termination of the NGINX worker process, resulting in a Denial of Service (DoS), or allow the modification of source or destination file names outside the intended document root. The impact on integrity is limited as the NGINX worker process operates with low privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the MOVE and COPY methods within the ngx http dav module when used with prefix locations and alias directives.