---
id: 6165
title: "CVE-2026-9256 — NGINX ngx_http_rewrite_module Overlapping PCRE Captures Heap Buffer Overflow RCE"
cve: CVE-2026-9256
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260525-cve-2026-9256-nginx-ngx-http-rewrite-module-overlapping-pcre-captures-heap-buffer-overflow-rce/"
published_at: "2026-05-25T00:00:00Z"
tags: ["rce", "heap-overflow", "nginx", "cve-2026-9256", "pcre"]
phying_url: "https://phying.com/item/6165"
lang: en
---

# CVE-2026-9256 — NGINX ngx_http_rewrite_module Overlapping PCRE Captures Heap Buffer Overflow RCE

## Summary

CVE-2026-9256: nginx rewrite-module heap overflow when overlapping PCRE captures re-expand—giving heap-write and info-leak primitives for a viable RCE path; fixed in 1.31.1 and 1.30.2.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-9256
- **Published:** 2026-05-25T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260525-cve-2026-9256-nginx-ngx-http-rewrite-module-overlapping-pcre-captures-heap-buffer-overflow-rce/
- **Phying News:** https://phying.com/item/6165