CVE-2026-27654

CVE-2026-27654 is a high-severity buffer overflow vulnerability affecting NGINX Open Source and NGINX Plus, specifically within the ngx_http_dav_module when configured with MOVE or COPY methods, prefix location, and alias directives. This flaw is remotely exploitable with low attack complexity, requiring no privileges or user interaction. Successful exploitation could lead to the termination of the NGINX worker process, resulting in a high availability impact, and potentially allow modification of file names outside the document root, though integrity impact is constrained by low worker process privileges. With a CVSS score of 8.2, this vulnerability is not currently known to be actively exploited, nor is there public exploit code available. Community discussion and media coverage remain limited.