CVE-2026-34830 Details
Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
A vulnerability exists in Rack's handling of the X-Accel-Mapping request header within the Rack::Sendfile module, prior to versions 2.2.23, 3.1.21, and 3.2.6. The issue arises because the X-Accel-Mapping header value is interpolated directly into a regular expression without proper escaping. This flaw allows an attacker to inject regex metacharacters, manipulating the resulting X-Accel-Redirect response header. In deployments using Rack::Sendfile with X-Accel-Redirect, this could enable an attacker to cause Nginx to serve unintended files from internal locations.
Users are advised to update Rack to version 2.2.23, 3.1.21, or 3.2.6. Additionally, X-Accel-Mapping headers can be stripped or overwritten at the reverse proxy to prevent client-supplied values from reaching Rack.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-625 | Permissive Regular Expression | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rack rack | < 2.2.23 >= 3.0.0, < 3.1.21 >= 3.2.0, < 3.2.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |