Restart and conditional code execution via capture overwrite

Heap buffer overflow in F5 NGINX Open Source and NGINX Plus allows remote attackers to restart workers or execute code via crafted HTTP requests. During two-pass string evaluation, a regex-based map or non-cacheable variable overwrites capture state after length calculation, so the worker writes the resulting string into an undersized heap buffer. The data-plane path is reachable without authentication only under the affected configuration; code execution additionally requires disabled ASLR or an ASLR bypass, while the direct outcome is a worker restart.