{"kind": "product", "path": "vulns/alpine-v3.21/nginx", "name": "nginx", "product": "nginx", "ecosystem": "Alpine:v3.21", "items": [{"id": "ALPINE-CVE-2026-60005", "noindex": false, "published": "2026-07-15T16:16:49.820Z", "modified": "2026-10-01T02:17:49.374912916Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-60005", "title": "ALPINE-CVE-2026-60005", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\nImpact:\nThis vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\nNote: The ngx_http_slice_module module is not ena", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-60005", "https://osv.dev/vulnerability/ALPINE-CVE-2026-60005"], "fixes": ["1.26.3-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-56434", "noindex": false, "published": "2026-07-15T15:16:45.700Z", "modified": "2026-10-01T02:17:49.358487517Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-56434", "title": "ALPINE-CVE-2026-56434", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.\n\nImpact:\nThis vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker ", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-56434", "https://osv.dev/vulnerability/ALPINE-CVE-2026-56434"], "fixes": ["1.26.3-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-42533", "noindex": false, "published": "2026-07-15T15:16:33.480Z", "modified": "2026-10-01T02:17:49.294981697Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-42533", "title": "ALPINE-CVE-2026-42533", "description": "A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Ran", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-42533", "https://osv.dev/vulnerability/ALPINE-CVE-2026-42533"], "fixes": ["1.26.3-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-48142", "noindex": false, "published": "2026-06-17T15:16:59.040Z", "modified": "2026-10-01T02:17:49.319509263Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-48142", "title": "ALPINE-CVE-2026-48142", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-48142", "https://osv.dev/vulnerability/ALPINE-CVE-2026-48142"], "fixes": ["1.26.3-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-42055", "noindex": false, "published": "2026-06-17T15:16:50.353Z", "modified": "2026-10-01T02:17:49.289957444Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-42055", "title": "ALPINE-CVE-2026-42055", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on sys", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-42055", "https://osv.dev/vulnerability/ALPINE-CVE-2026-42055"], "fixes": ["1.26.3-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-49975", "noindex": false, "published": "2026-06-08T16:16:44.223Z", "modified": "2026-10-01T02:17:49.328126004Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-49975", "title": "ALPINE-CVE-2026-49975", "description": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-49975", "https://osv.dev/vulnerability/ALPINE-CVE-2026-49975"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-9256", "noindex": false, "published": "2026-05-22T15:16:27.073Z", "modified": "2026-10-01T02:17:49.420874630Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-9256", "title": "ALPINE-CVE-2026-9256", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute co", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-9256", "https://osv.dev/vulnerability/ALPINE-CVE-2026-9256"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-42946", "noindex": false, "published": "2026-05-13T16:16:50.340Z", "modified": "2026-10-01T02:17:49.299433226Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-42946", "title": "ALPINE-CVE-2026-42946", "description": "A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-42946", "https://osv.dev/vulnerability/ALPINE-CVE-2026-42946"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-42945", "noindex": false, "published": "2026-05-13T16:16:50.190Z", "modified": "2026-10-01T02:17:49.299252626Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-42945", "title": "ALPINE-CVE-2026-42945", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomiza", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-42945", "https://osv.dev/vulnerability/ALPINE-CVE-2026-42945"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-42934", "noindex": false, "published": "2026-05-13T16:16:49.910Z", "modified": "2026-10-01T02:17:49.298460673Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-42934", "title": "ALPINE-CVE-2026-42934", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-42934", "https://osv.dev/vulnerability/ALPINE-CVE-2026-42934"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-40701", "noindex": false, "published": "2026-05-13T16:16:43.863Z", "modified": "2026-10-01T02:17:49.279814595Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-40701", "title": "ALPINE-CVE-2026-40701", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \"on\" or \"optional,\" and the ssl_ocsp directive is set to \"on\" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-40701", "https://osv.dev/vulnerability/ALPINE-CVE-2026-40701"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2026-40460", "noindex": false, "published": "2026-05-13T16:16:42.823Z", "modified": "2026-10-01T02:17:49.277422821Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2026-40460", "title": "ALPINE-CVE-2026-40460", "description": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2026-40460", "https://osv.dev/vulnerability/ALPINE-CVE-2026-40460"], "fixes": ["1.26.3-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2025-23419", "noindex": false, "published": "2025-02-05T18:15:33.347Z", "modified": "2026-08-27T22:18:02.831169716Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2025-23419", "title": "ALPINE-CVE-2025-23419", "description": "When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when  TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key  are used and/or the  SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache  are used in the default server and the default server is performing client certificate authentication.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-23419", "https://osv.dev/vulnerability/ALPINE-CVE-2025-23419"], "fixes": ["1.26.3-r0"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2024-7347", "noindex": false, "published": "2024-08-14T15:15:31.870Z", "modified": "2026-09-15T08:17:48.501502481Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2024-7347", "title": "ALPINE-CVE-2024-7347", "description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-7347", "https://osv.dev/vulnerability/ALPINE-CVE-2024-7347"], "fixes": ["1.26.2-r0"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2023-44487", "noindex": false, "published": "2023-10-10T14:15:10.883Z", "modified": "2026-10-23T17:17:56.784711129Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2023-44487", "title": "ALPINE-CVE-2023-44487", "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-44487", "https://osv.dev/vulnerability/ALPINE-CVE-2023-44487"], "fixes": ["1.24.0-r12"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2022-41742", "noindex": false, "published": "2022-10-19T22:15:12.717Z", "modified": "2026-10-15T07:17:54.252774646Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2022-41742", "title": "ALPINE-CVE-2022-41742", "description": "NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-41742", "https://osv.dev/vulnerability/ALPINE-CVE-2022-41742"], "fixes": ["1.22.1-r0"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2022-41741", "noindex": false, "published": "2022-10-19T22:15:12.647Z", "modified": "2026-10-15T07:17:54.252463927Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2022-41741", "title": "ALPINE-CVE-2022-41741", "description": "NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file wi", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-41741", "https://osv.dev/vulnerability/ALPINE-CVE-2022-41741"], "fixes": ["1.22.1-r0"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2021-3618", "noindex": false, "published": "2022-03-23T20:15:09.833Z", "modified": "2026-10-23T17:17:56.199330427Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2021-3618", "title": "ALPINE-CVE-2021-3618", "description": "ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-3618", "https://osv.dev/vulnerability/ALPINE-CVE-2021-3618"], "fixes": ["1.20.1-r1"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2022-25139", "noindex": false, "published": "2022-02-14T22:15:08.317Z", "modified": "2026-10-15T07:17:54.172429010Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2022-25139", "title": "ALPINE-CVE-2022-25139", "description": "njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-25139", "https://osv.dev/vulnerability/ALPINE-CVE-2022-25139"], "fixes": ["1.20.2-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}, {"id": "ALPINE-CVE-2021-46463", "noindex": false, "published": "2022-02-14T22:15:07.793Z", "modified": "2026-10-23T17:17:56.231097628Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/alpine-cve-2021-46463", "title": "ALPINE-CVE-2021-46463", "description": "njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-46463", "https://osv.dev/vulnerability/ALPINE-CVE-2021-46463"], "fixes": ["1.20.2-r2"], "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}]}], "total": 31, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nginx", "path": "vulns/alpine-v3.21/nginx", "ecosystem": "Alpine:v3.21"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-23T17:17:56.784711129Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}