nginx merge_slashes Path Confusion Vulnerability (CVE-2025-23419)

CVE-2025-23419 affects nginx when merge_slashes off is set and alias/location paths overlap. Attackers craft URLs with duplicate slashes to bypass access controls or reach unintended static files.

When you are exposed

• nginx before 1.26.3 or 1.27.4 (verify vendor package)
• Configs using merge_slashes off;
• Overlapping location and alias blocks

Inspect config

nginx -v
grep -R 'merge_slashes' /etc/nginx/
nginx -t && nginx -T | grep -A2 'location'

Mitigation

• Upgrade nginx to fixed release
• Remove merge_slashes off unless strictly required
• Normalize URLs at reverse proxy / WAF layer
• Test //admin and /static//../ style paths in staging

Often chained with cache poisoning or auth bypass on multi-tenant apps.