Critical NGINX heap overflow enables RCE via crafted HTTP requests

Affected Systems

NGINX open source versions prior to 1.30.4 and 1.31.3, and NGINX Plus versions prior to 37.0.3.1. All deployments accepting HTTP requests from untrusted networks are at risk.

Exploitation Status

Patches released July 15. No public information on active exploitation or PoC availability at this time. Remote unauthenticated attack vector significantly increases risk.

Business Impact

Unauthenticated attackers can crash NGINX worker processes (denial of service) or potentially achieve remote code execution on internet-facing web servers and reverse proxies. Given NGINX's widespread deployment as a front-end server, this vulnerability exposes critical infrastructure to compromise. Immediate patching required for all exposed instances.

Urgency

🔴 Immediate

Recommended Actions

• Upgrade NGINX open source to version 1.30.4, 1.31.3, or later immediately
• Upgrade NGINX Plus to version 37.0.3.1 or later immediately
• Prioritize patching of internet-facing NGINX instances within 24 hours
• Monitor NGINX error logs and system logs for worker process crashes or unexpected restarts indicating exploitation attempts
• Deploy WAF rules to detect and block malformed HTTP requests if immediate patching is not feasible
• Verify patch deployment across all NGINX instances including containerized and cloud environments