Critical NGINX Vulnerability CVE-2024-35200 Lets Attackers Achieve RCE

Key Takeaways

• A new zero-day RCE vulnerability, “nginx-poolslip,” has been discovered in NGINX.
• The flaw specifically impacts NGINX version 1.31.0, the latest stable release.
• Discovered by NebSec’s agent Vega, it allows remote code execution without authentication.
• There is no official patch available from NGINX/F5 at the time of reporting.

A critical zero-day remote code execution (RCE) vulnerability, dubbed “nginx-poolslip,” has been publicly disclosed, affecting NGINX version 1.31.0, which is the web server software’s most current stable release. This newly identified flaw presents a significant risk to the vast number of systems relying on NGINX.

The discovery of nginx-poolslip was made by security agent Vega, working with the NebSec security team. The vulnerability was brought to public attention via a post on X (formerly Twitter) on May 21, 2026.

This revelation comes just weeks after the cybersecurity community scrambled to address CVE-2026-42945, a severe heap buffer overflow in NGINX’s ngx_http_rewrite_module. That previous vulnerability carried a CVSS v4 score of 9.2.

CVE-2026-42945 had been present in the NGINX codebase since 2008 and potentially exposed around 5.7 million internet-facing NGINX servers to denial-of-service attacks and conditional remote code execution. F5, the company behind NGINX, released patches for NGINX Open Source 1.31.0 and 1.30.1, necessitating urgent upgrades for administrators globally.

NGINX 0-Day RCE “nginx-poolslip”

The “nginx-poolslip” vulnerability is an RCE flaw that specifically targets NGINX’s internal memory pool handling mechanisms. This critical vulnerability could allow attackers to execute arbitrary code on affected servers, potentially leading to a complete system compromise without requiring any prior authentication.

NebSec describes the vulnerability as an Address Space Layout Randomization (ASLR) bypass. ASLR is a fundamental operating system-level memory protection technique designed to mitigate the exploitation of memory corruption bugs.

This new vulnerability follows a previously patched flaw known as “nginx-rift,” which affected older NGINX versions and has since been remediated. However, NebSec’s analysis indicates that the patch developed for “nginx-rift” did not fully address the underlying attack surface that “nginx-poolslip” now exploits. NebSec’s initial disclosure tweet can be seen below:

Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.

nginx-rift has been patched, but our security agent Vega has found a new 0 day.

We will release the full technical writeup with ASLR bypass 30 days after the patch on https://t.co/LAhOC5UHrp. pic.twitter.com/4rqMp4uA4i

— Nebula Security (@nebusecurity) May 20, 2026

NGINX is a foundational component of the internet, powering an estimated 30–40% of all web servers globally. Its extensive use includes high-traffic web platforms, reverse proxies, load balancers, and API gateways. The critical aspect of “nginx-poolslip” is that it targets the latest stable release, version 1.31.0, meaning organizations that diligently updated to mitigate “nginx-rift” may now be vulnerable to this new threat.

As of the time of this publication, an official patch from the NGINX project has not yet been released. NebSec has stated its adherence to a 30-day responsible disclosure timeline, committing to withhold the complete technical write-up, including specific ASLR bypass details, until after an official patch becomes available. Currently, no CVE identifier has been assigned, and NGINX/F5 has not provided an official fix for “nginx-poolslip.”

What You Should Do

Until an official patch is released, administrators should implement the following interim measures:

• Actively monitor NebSec and F5 security advisories for updates regarding patch availability.
• Restrict public exposure of NGINX administration interfaces and reduce the attack surface by employing Web Application Firewall (WAF) rules.
• Ensure system-wide ASLR is enabled (by setting /proc/sys/kernel/randomize_va_space to 2) as a partial mitigation strategy.
• Thoroughly audit NGINX configurations for rewrite, if, and set directives that utilize unnamed PCRE capture groups, as these are known preconditions for related pool-level corruption issues.
• For critical infrastructure, evaluate the feasibility of migrating to memory-safe alternatives such as Cloudflare Pingora.

Given NGINX’s pervasive role in global web infrastructure, the cybersecurity community is closely monitoring NebSec’s coordinated disclosure process. Organizations are strongly advised to subscribe to F5’s security bulletin feed and prepare emergency patching workflows in anticipation of an imminent fix.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.