Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-60005— NGINX ngx_http_slice_module vulnerability

Quick assessment

Affected

F5 NGINX Plus

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

F5 nginx plus是美国F5公司的一款高性能Web服务器和反向代理。 F5 NGINX Plus存在资源管理错误漏洞，该漏洞源于ngx_http_slice_module模块，当配置slice指令和未命名正则表达式捕获或发生后台缓存更新时，未经身份验证的攻击者可以发送请求，导致NGINX worker进程中的未初始化内存访问，从而有限地泄露内存内容或导致重启。以下版本受到影响：NGINX Plus 37.0.3.1之前版本、R36 P7之前版本、R33版本；NGINX Open Source 1.

CVSS 8.2 · High EPSS 0.53% · P45 Updated Jul 16, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1498 · Network Denial of Service

Affected Version Matrix 5

Vendor	Product	Version Range	Status
F5	NGINX Open Source	`1.31.2< 1.31.3`	affected
		`1.15.8< 1.30.4`	affected
F5	NGINX Plus	`37.0.0.1< 37.0.3.1`	affected
		`R36< R36 P7`	affected
		`R33< *`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-60005

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NGINX ngx_http_slice_module vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对未经初始化资源的使用

Source: CVE Program / CVE List V5

Vulnerability Title

F5 NGINX Plus 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
F5	NGINX Plus	37.0.0.1 ~ 37.0.3.1	-
F5	NGINX Open Source	1.31.2 ~ 1.31.3	-

II. Public POCs for CVE-2026-60005

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

default-local-qwen3.6 · 11879 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-60005

请登录查看更多情报信息。

Other References for CVE-2026-60005 (1)

https://my.f5.com/manage/s/article/K000162100 vendor-advisory patch

https://www.cve.org/CVERecord?id=CVE-2026-60005

Same Patch Batch · F5 · 2026-07-15 · 8 CVEs total

CVE-2026-55723	8.3 HIGH	NGINX Ingress Controller vulnerability
CVE-2026-42533	8.1 HIGH	NGINX Map directive and Regex matching vulnerability
CVE-2026-59762	7.5 HIGH	BIG-IP HTTP/2 vulnerability
CVE-2026-52865	6.5 MEDIUM	NGINX Ingress Controller vulnerability
CVE-2026-56434	6.5 MEDIUM	NGINX ngx_http_ssi_module vulnerability
CVE-2026-60062	6.4 MEDIUM	NGINX Agent Vulnerability
CVE-2026-60065	3.7 LOW	NGINX Plus ngx_stream_mqtt_filter_module vulnerability

IV. Related Vulnerabilities

Same product: NGINX Plus

Same vendor: F5

Same weakness: CWE-908