CVE-2026-27654: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an at

This week

HIGH 8.2REMOTEWATCHLISTDOWNGRADEUPGRADE

CVE-2026-27654 is a high-severity flaw (CVSS 8.2) affecting nginx plus, nginx open source. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefi

Why this priority

High severity
EPSS top 2%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.2 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	25.9% (top 2%)
CISA exploited list	No
Weakness	CWE-122, CWE-120
Published	2026-03-24
Last modified	2026-07-15

Publisher (CNA): F5 Networks · Vendor: f5

Last updated 2026-07-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-03-24 15:16 UTCPublished CVE record published
2026-07-15 02:19 UTCUpdated Record last modified

f5 nginx plus DOWNGRADE

Affected: r32 p1 · r32 p2 · r32 p3 · r32 p4 · r33 · r33 p1 · r33 p2 · r33 p3

Fixed in: no fixed release known

Safe to downgrade to: a release before r32

1. Check installed version

apt-cache policy nginx-plus || rpm -q nginx-plus || nginx-plus --version

2. No fixed release: DOWNGRADE to a release before r32 (Debian / Ubuntu)

apt-cache madison nginx-plus sudo apt install nginx-plus=<VERSION_BEFORE_r32> sudo apt-mark hold nginx-plus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list nginx-plus sudo dnf downgrade nginx-plus-<VERSION_BEFORE_r32> sudo dnf versionlock add nginx-plus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

f5 nginx open source UPGRADE

Affected: >= 0.5.13 and <= 0.9.7 · >= 1.0.0 and < 1.28.3 · >= 1.29.0 and < 1.29.7

Fixed in: 1.28.3, 1.29.7

Safe to downgrade to: a release before 0.5.13

1. Check installed version

apt-cache policy nginx-open-source || rpm -q nginx-open-source || nginx-open-source --version

2. UPGRADE to 1.28.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade nginx-open-source

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade nginx-open-source

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 0.5.13 (Debian / Ubuntu)

apt-cache madison nginx-open-source sudo apt install nginx-open-source=<VERSION_BEFORE_0.5.13> sudo apt-mark hold nginx-open-source

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list nginx-open-source sudo dnf downgrade nginx-open-source-<VERSION_BEFORE_0.5.13> sudo dnf versionlock add nginx-open-source

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora ELN · perl-Encode · FIXED · 3.25-528.eln159 · FEDORA-2026-79991d0238 · source

sudo dnf upgrade --advisory=FEDORA-2026-79991d0238

Fedora 46 · fonttools · FIXED · 4.68.0-1.fc46 · FEDORA-2026-65d6c01c75 · source

sudo dnf upgrade --advisory=FEDORA-2026-65d6c01c75

Ubuntu 22.04 · nginx · FIXED · 1.18.0-6ubuntu14.10

sudo apt update && sudo apt install --only-upgrade nginx dpkg --compare-versions "$(dpkg-query -W -f='${Version}' nginx)" ge "1.18.0-6ubuntu14.10" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · nginx · FIXED · 1.24.0-2ubuntu7.7

sudo apt update && sudo apt install --only-upgrade nginx dpkg --compare-versions "$(dpkg-query -W -f='${Version}' nginx)" ge "1.24.0-2ubuntu7.7" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 25.10 · nginx · FIXED · 1.28.0-6ubuntu1.2

sudo apt update && sudo apt install --only-upgrade nginx dpkg --compare-versions "$(dpkg-query -W -f='${Version}' nginx)" ge "1.28.0-6ubuntu1.2" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 20.04 · nginx · FIXED · 1.18.0-0ubuntu1.7+esm1

sudo apt update && sudo apt install --only-upgrade nginx dpkg --compare-versions "$(dpkg-query -W -f='${Version}' nginx)" ge "1.18.0-0ubuntu1.7+esm1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · nginx · FIXED · 1.22.1-9+deb12u5

sudo apt update && sudo apt install --only-upgrade nginx dpkg --compare-versions "$(dpkg-query -W -f='${Version}' nginx)" ge "1.22.1-9+deb12u5" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · nginx · FIXED · 1.26.3-3+deb13u3

sudo apt update && sudo apt install --only-upgrade nginx dpkg --compare-versions "$(dpkg-query -W -f='${Version}' nginx)" ge "1.26.3-3+deb13u3" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · nginx · FIXED · nginx-1.26.3-2.el10_1.1

sudo dnf upgrade --advisory=RHSA-2026:6906 rpm -q nginx

RHEL 10.0 Extended Update Support · nginx · FIXED · nginx-1.26.3-1.el10_0.8

sudo dnf upgrade --advisory=RHSA-2026:13634 rpm -q nginx

RHEL 9 · nginx · FIXED · nginx-1.20.1-24.el9_7.2

sudo dnf upgrade --advisory=RHSA-2026:7002 rpm -q nginx

RHEL 9.0 Update Services for SAP Solutions · nginx · FIXED · nginx-1.20.1-10.el9_0.3

sudo dnf upgrade --advisory=RHSA-2026:15942 rpm -q nginx

RHEL 9.2 Update Services for SAP Solutions · nginx · FIXED · nginx-1.20.1-14.el9_2.5

sudo dnf upgrade --advisory=RHSA-2026:14836 rpm -q nginx

Alpine 3.22 · nginx · FIXED · nginx-1.28.3-r0

apk add --upgrade nginx apk info -v nginx

Alpine 3.23 · nginx · FIXED · nginx-1.28.3-r0

apk add --upgrade nginx apk info -v nginx

Alpine 3.24 · nginx · FIXED · nginx-1.28.3-r0

apk add --upgrade nginx apk info -v nginx

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-1540 · source

sudo dnf update --advisory=ALAS2023-2026-1540

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: JohannesLks/CVE-2026-27654 (9 stars)
GitHub PoC: Debajyoti0-0/CVE-2026-27654-PoC (2 stars)
GitHub PoC: dead-lamer/CVE-2026-27654 (0 stars)

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-27654?

nginx plus: downgrade or apply the listed mitigation; nginx open source: upgrade to 1.28.3, 1.29.7. Exact commands for each OS are on this page.

Is CVE-2026-27654 being exploited?

CVE-2026-27654 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-27654 affect?

CVE-2026-27654 affects nginx plus, nginx open source. Severity is high (CVSS 8.2). NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker

How urgent is CVE-2026-27654?

Priority 68/100. High severity; EPSS top 2%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist

Software pages

nginx vulnerabilities · F5 BIG-IP vulnerabilities

Related CVEs

CVE-2026-40460 MEDIUM 6.5 UPGRADE UPGRADE When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to
CVE-2026-40701 MEDIUM 4.8 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_cl
CVE-2026-42945 HIGH 8.1 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
CVE-2026-42946 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excess
CVE-2026-42934 MEDIUM 4.8 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module

References

← Back to latest CVEs