CVE-2026-27654 F5 CVE debrief

Who should care

NGINX Open Source and NGINX Plus users should be aware of this vulnerability, especially those with configurations that use the DAV module's MOVE or COPY methods, prefix locations, and alias directives. The vulnerability's high severity and potential for disruption make it a priority for NGINX administrators to assess their configurations and apply mitigations or patches as needed.

Technical summary

The vulnerability, tracked as CVE-2026-27654, is located in the ngx_http_dav_module module of NGINX Open Source and NGINX Plus. It can be exploited by an attacker to trigger a buffer overflow in the NGINX worker process, potentially leading to process termination or modification of file names outside the document root. The vulnerability requires specific configuration conditions to be exploitable: the use of DAV module MOVE or COPY methods, prefix location (non-regular expression location configuration), and alias directives. The CVSS:4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, indicating a high severity score of 8.8. The vulnerability is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-120 (Buffer Overflow)

Defensive priority

This vulnerability has a high CVSS score of 8.8 and could lead to disruption of NGINX services or unauthorized file modifications. NGINX administrators should prioritize assessment and mitigation of this vulnerability, especially if their configurations use the affected modules and directives.

Recommended defensive actions

• Review NGINX configurations for use of DAV module MOVE or COPY methods, prefix locations, and alias directives.
• Assess the privileges of the NGINX worker process user and consider additional access controls.
• Monitor NGINX logs for unusual activity indicative of potential exploitation attempts.
• Apply patches or updates provided by F5 as soon as possible.
• Consider implementing compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent exploitation attempts.

Evidence notes

The CVE-2026-27654 record was published on March 24, 2026, and last modified on June 30, 2026. The vulnerability affects multiple versions of NGINX Open Source and NGINX Plus. F5 has provided a vendor advisory (K000160382) with mitigation details. Red Hat has also published several errata related to this vulnerability, affecting various Red Hat products.

Official resources