It's a well documented feature that has existed since always. The vulnerability arises because the obvious way to configure this handler in nginx is to write re

It's a well documented feature that has existed since always. The vulnerability arises because the obvious way to configure this handler in nginx is to write regexps. You could just as well have handed the user a loaded gun pointed at their foot.