In NGINX, a complex value is an expression built from static text and variables, then evaluated at runtime. Instead of using one fixed string, the configuration can assemble a result dynamically as request or stream data is processed.
This matters because runtime evaluation turns configuration into a data-processing path. When complex values are used with regex matches, maps, or preread logic, NGINX must copy, expand, and interpret values safely in C. That creates security risk if length calculations, buffer handling, or variable expansion are wrong, because attacker-controlled input can influence the generated string.
Defenders should treat complex values as part of the attack surface. Review configurations that combine them with external input, test edge cases, and keep NGINX updated. Used carefully, complex values are a powerful routing tool; used carelessly, they can help expose memory-safety bugs or unexpected control flow.