Nginx: memory disclosure vulnerability CVE-2026-60005 when using the slice module

CVE-2026-60005 Nginx

Nginx has a memory disclosure vulnerability, CVE-2026-60005, when using ngx_http_slice_module. Versions 1.15.8–1.31.2 are affected; check the version and configuration, then upgrade to 1.31.3 or later, or 1.30.4 or later.

Nginx: memory disclosure vulnerability CVE-2026-60005 when using the slice module

At a glance
Nginx has a memory disclosure vulnerability, CVE-2026-60005.
Versions 1.15.8–1.31.2 are affected when using ngx_http_slice_module.
Upgrade to Nginx 1.31.3 or later, or 1.30.4 or later.

In this article

Nginx Security has reported vulnerability CVE-2026-60005, which is associated with ngx_http_slice_module and may disclose memory contents. See the Nginx Security advisory for the source information.

Overview and technical details

Nginx is a web server and reverse proxy; ngx_http_slice_module divides responses into smaller parts for processing. The vulnerability may disclose memory contents when this module is used.

Field	Details
Product	Nginx
Vulnerability	CVE-2026-60005
Severity	Medium
Source	Nginx Security

Affected systems

Nginx versions 1.15.8–1.31.2 are affected when the configuration uses ngx_http_slice_module. The source confirms that versions 1.31.3 or later and 1.30.4 or later are unaffected.

System checks

Check the running Nginx version:
```
nginx -v
```
Check whether the configuration uses the slice module:
```
nginx -T 2>&1 | grep -E 'ngx_http_slice_module|slice;'
```

If the version is within 1.15.8–1.31.2 and the configuration uses the slice module, upgrade is needed. Versions 1.31.3 or later, or 1.30.4 or later, are unaffected.