One-byte memory overwrite in nginx Web Server and NGINX Plus resolver

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

• nginx Web Server: versions 0.6.18 through 1.20.0 are marked affected. The nginx advisory states that the issue is fixed in 1.20.1 and 1.21.0. The status of later or parallel branches is not established beyond the releases named in the advisory.
• NGINX Plus: R13 through R23 before R23 P1, and R24 before R24 P1, are marked affected in the normalized record. The status of other NGINX Plus branches is not established by the available evidence.
• Downstream products that bundle nginx may have vendor-specific exposure and fixes. The direct nginx version boundaries should not be assumed to apply unchanged to every product that embeds nginx.

nginx processes DNS responses through its resolver path when the resolver directive is configured. A specially crafted DNS response can trigger a 1-byte memory overwrite during DNS server response processing. The attacker must be able to forge UDP packets from the configured DNS server, making the attack technically remote but dependent on this packet-forgery capability. The overwrite can crash the worker process; the nginx advisory also warns that arbitrary code execution may be possible. The record classifies the weakness as CWE-193, but the reviewed evidence does not disclose the overwritten field, exact code location, or a reliable exploit chain.

The attack is network reachable and requires no authentication or user interaction according to the supplied attributes. Complexity is high because the attacker must forge UDP packets from the DNS server. Exposure exists only when the configuration uses the resolver directive. The nginx advisory does not provide a directly usable exploit sequence. Available evidence does not establish active exploitation, observed abuse, or a validated public exploit; a third-party reference in the record is not treated as confirmation because its contents could not be inspected.

The confirmed technical outcome is a 1-byte memory overwrite in the nginx resolver that can crash a worker process and reduce service availability. The nginx advisory identifies potential arbitrary code execution, so successful exploitation could affect confidentiality and integrity as well as availability. The attack does not require authentication or user interaction, but it does require the ability to forge UDP packets from the DNS server, which materially limits reachability. The available evidence does not show that arbitrary code execution occurred or provide a reliable exploit chain.

The flaw can crash worker processes, interrupt request handling, and require service restart or failover depending on the deployment architecture. Systems using resolver should be prioritized, especially where the DNS path permits forged UDP responses. If arbitrary code execution were achieved, the impact could extend from service disruption to confidentiality and integrity compromise. The available evidence does not confirm a breach, data disclosure, or control of a specific system.

1. For nginx Web Server, update deployments from 0.6.18 through 1.20.0 to the fixed release applicable to the branch: 1.20.1 or 1.21.0. Do not assume that unlisted branches are covered.
2. For NGINX Plus, update affected R23 deployments to R23 P1 and affected R24 deployments to R24 P1. Verify the vendor's fix mapping separately for other Plus branches.
3. Inventory configurations using resolver and prioritize systems whose workers can receive DNS responses over a path where UDP packets may be forged.
4. The reviewed evidence does not establish a complete vendor-confirmed workaround. Removing or disabling resolver may reduce exposure only where operationally acceptable, but it is not a substitute for updating.

• Inventory nginx Web Server versions and NGINX Plus releases across hosts, images, and appliances that include nginx.
• Inspect configurations to identify systems using the resolver directive, which nginx identifies as an exposure condition.
• Review worker process crash, restart, or instability events occurring during DNS response processing. This is an investigative symptom, not a confirmed IOC.
• Assess the network path to each DNS server and whether an untrusted source could forge DNS UDP packets in that environment.
• No specific IOC or confirmed log pattern was provided. The absence of crashes does not prove that a system is safe.