CVE-2026-27654 — NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module…¶

Key facts

CVE-2026-27654 (F5/NGINX) is a High (8.2) vulnerability: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module…. This entry ships ready-to-deploy detection and prevention rules (Snort, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-27654
Severity	High (8.2)
Vendor	F5/NGINX
Detection / prevention	Snort, Sigma
PoC	poc.py
Source	2026/CVE-2026-27654/

Details¶

CVE-2026-27654 (F5/NGINX) is a High (8.2) vulnerability: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Description¶

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that allows an attacker to trigger a buffer overflow in the NGINX worker process. This vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root.

This issue affects NGINX when the configuration file uses DAV module MOVE or COPY methods, prefix location (non-regular expression location configuration), and alias directives.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-27654
Type	Buffer Overflow
CWE	CWE-120: Buffer Copy without Checking Size of Input
CVSS Score	8.2 (High)
Attack Vector	Network
Affected Product	NGINX Open Source / NGINX Plus
Vendor	F5/NGINX

Affected Configuration¶

location /uploads/ {
    alias /var/www/files/;
    dav_methods PUT DELETE MOVE COPY;
}

The vulnerability requires: - ngx_http_dav_module enabled - dav_methods with MOVE or COPY - Prefix location (not regex) - alias directive

PoC Usage¶

python3 poc.py --target <host> --port <port> --path /uploads/
python3 poc.py --target <host> --port 443 --path /uploads/ --ssl

The PoC sends crafted MOVE/COPY requests with oversized Destination headers containing directory traversal sequences to trigger the buffer overflow.

Impact¶

DoS: Worker process crash (signal 11/SIGSEGV)
File Manipulation: Source or destination file names may be modified outside the document root
Limited Integrity Impact: NGINX worker process runs with low privileges

Prevention¶

See the prevention/ directory for: - Snort rules: Detect oversized Destination headers and path traversal in DAV requests - Sigma rules: Detect DAV method failures and worker process crashes

Recommended Mitigations¶

Update NGINX to the latest patched version
Disable DAV module if not required (--without-http_dav_module)
Restrict DAV methods to only what is needed
Use regex locations instead of prefix locations with alias
Limit Destination header size via large_client_header_buffers

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-27654, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
Detection-only PoC — poc.py

References: NVD — CVE-2026-27654 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signature

# CVE-2026-27654 - NGINX ngx_http_dav_module Buffer Overflow
# Detection: Crafted MOVE/COPY requests with oversized Destination headers

# Rule 1: Detect WebDAV MOVE with oversized Destination header
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-27654 NGINX DAV MOVE Buffer Overflow Attempt";
    flow:to_server,established;
    content:"MOVE "; depth:5;
    content:"Destination|3a|"; nocase;
    isdataat:4096,relative;
    pcre:"/^MOVE\s+\S+\s+HTTP\/1\.[01]\r\n(?:.*?\r\n)*?Destination\s*:\s*.{4096}/smi";
    classtype:web-application-attack;
    sid:2026276541; rev:1;
    metadata:cve CVE-2026-27654, severity high, cvss 8.2;
    reference:cve,2026-27654;
)

# Rule 2: Detect WebDAV COPY with oversized Destination header
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-27654 NGINX DAV COPY Buffer Overflow Attempt";
    flow:to_server,established;
    content:"COPY "; depth:5;
    content:"Destination|3a|"; nocase;
    isdataat:4096,relative;
    pcre:"/^COPY\s+\S+\s+HTTP\/1\.[01]\r\n(?:.*?\r\n)*?Destination\s*:\s*.{4096}/smi";
    classtype:web-application-attack;
    sid:2026276542; rev:1;
    metadata:cve CVE-2026-27654, severity high, cvss 8.2;
    reference:cve,2026-27654;
)

# Rule 3: Detect directory traversal in DAV Destination header
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-27654 NGINX DAV Destination Path Traversal";
    flow:to_server,established;
    content:"Destination|3a|"; nocase;
    content:"/../"; distance:0;
    content:"/../"; distance:0;
    content:"/../"; distance:0;
    pcre:"/^(MOVE|COPY)\s+/smi";
    classtype:web-application-attack;
    sid:2026276543; rev:1;
    metadata:cve CVE-2026-27654, severity high, cvss 8.2;
    reference:cve,2026-27654;
)

:material-file-download: prevention/snort.rules

Frequently asked questions¶

What is CVE-2026-27654?¶

CVE-2026-27654 (F5/NGINX) is a High (8.2) vulnerability: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module…. This entry ships ready-to-deploy detection and prevention rules (Snort, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-27654?¶

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-27654?¶

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.