The map directive is an NGINX configuration construct that creates a new variable from the value of another variable. It can use exact matches, prefixes, and regular expressions, so one input value can drive different outputs at runtime.
In security terms, map matters because it turns configuration into logic. Operators use it for routing, access control, logging, and protocol handling, especially in Stream configurations where values may be derived from TLS preread data. That flexibility is useful, but it also expands the attack surface: regex matching and variable expansion add parsing steps and memory handling inside C code. When bugs exist in these paths, crafted input can trigger crashes or other memory-safety failures. Defenders should review map rules carefully, especially when they feed preread-based decisions or complex values.