### Vulnerability Details In NGINX Open Source and NGINX Plus, the `ngx_http_dav_module` module contains an unsigned integer underflow flaw in the `ngx_http_map_uri_to_path` function when mapping the `Destination` header path during processing of WebDAV `COPY` or `MOVE` requests. When the server is configured with a prefix `location` (non-regex) that simultaneously uses the `alias` directive and has `dav_methods COPY` or `dav_methods MOVE` enabled, an attacker can craft a specially constructed HTTP request to inject malicious path data via the `Destination` header. This flaw triggers a heap buffer overflow, which an attacker can leverage to perform arbitrary file path manipulation, arbitrary file writes, web shell deployment, or even remote code execution (RCE). In cases where exploitation of the write primitive fails, the vulnerability may also cause NGINX worker process crashes, resulting in a denial of service. ### Affected Versions - NGINX Open Source 0.5.13 <= version <= 0.9.7 - NGINX Open Source 1.0.0 <= version < 1.28.3 - NGINX Open Source 1.29.0 <= version < 1.29.7 - NGINX Plus R32 <= version < R32 P5 - NGINX Plus R33 all versions - NGINX Plus R34 all versions - NGINX Plus R35 <= version < R35 P2 - NGINX Plus R36 <= version < R36 P3 ### ### Remediation Please upgrade to the officially released fixed versions as soon as possible: - NGINX Open Source 1.28.3 or later - NGINX Open Source 1.29.7 or later - NGINX Plus R32 P5 or later - NGINX Plus R35 P2 or later - NGINX Plus R36 P3 or later After upgrading, restart the NGINX service to ensure the patch takes effect. ### Temporary Mitigations If an immediate upgrade is not possible, the following protective measures are recommended: - If your environment does not require WebDAV functionality, immediately remove the `dav_methods` directive or disable the `ngx_http_dav_module` module. - Avoid using the `alias` directive together with `dav_methods COPY/MOVE` within the same `location` block. - Consider replacing `alias` with the `root` directive, or restructure the URL path layout to avoid the conditions that trigger this vulnerability. - Restrict access sources via firewall or security groups, allowing only trusted IP addresses to reach the WebDAV service. - Strengthen monitoring for anomalous WebDAV requests, abnormally long `Destination` headers, and NGINX worker crash logs. ### References [https://my.f5.com/manage/s/article/K000160382](https://my.f5.com/manage/s/article/K000160382) [https://nvd.nist.gov/vuln/detail/CVE-2026-27654](https://nvd.nist.gov/vuln/detail/CVE-2026-27654)

UCloud-202604-001:NGINX ngx_http_dav_module Path Mapping Vulnerability