CVE-2026-93479: A July Patch Opened the Door to a New NGINX Heap Overflow

Among the five fixes in NGINX 1.30.6 and 1.31.7, CVE-2026-93479 is unusual because it is a regression introduced by a previous security fix. The flaw lives in the same string-handling code NGINX hardened in July 2026 for CVE-2026-42533, and the affected branches, 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6, begin before that July change. A server that was patched in July is inside the affected range either way.

What went wrong in July

The July patch added protection against overrunning a buffer in the code path that builds strings from regex map captures. Data could still spill into a reserved area, however, and a second July commit then sized the final string from that spilled length.…