p PatchFirst

PatchFirst · Latest vulnerabilities

nginx vulnerabilities

Vulnerabilities published for nginx in the last 30 days: 5. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 73

  1. CVE-2026-95101

    Medium · CVSS 6.9EPSS 0.25%Fix available

    NGINX ngx_http_v3_module vulnerability

    Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.4-8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-97205

    Critical · CVSS 9.2EPSS 0.48%Fix available

    NGINX ngx_http_core_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or po

    nginxOperating systems Web servers
    • Update to 1.30.4-8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-93479

    Critical · CVSS 9.2EPSS 0.55%Fix available

    NGINX map directive and regex matching vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Addr

    nginxOperating systems Web servers
    • Update to 1.30.4-8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-97629

    High · CVSS 8.3EPSS 0.18%Fix available

    NGINX ngx_http_ssl_module vulnerability

    Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane ex

    nginxOperating systems Web servers
    • Update to 1.30.4-8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-15176

    Critical · CVSS 9.2EPSS 0.52%Fix available

    NGINX ngx_http_core_module vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Rando

    nginxOperating systems Web servers
    • Update to 1.30.4-8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-90439

    Medium · CVSS 6.9EPSS 0.26%Fix available

    NGINX ngx_http_v3_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plan

    nginxOperating systems Web servers
    • Update to 1.30.4-7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-60005

    High · CVSS 8.8EPSS 0.53%Fix available

    NGINX ngx_http_slice_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not ena

    nginxOperating systems Web servers
    • Update to 1.30.1-7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-56434

    High · CVSS 8.3EPSS 0.42%Fix available

    NGINX ngx_http_ssi_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker

    nginxOperating systems Web servers
    • Update to 1.30.1-7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-42533

    Critical · CVSS 9.2EPSS 0.89%Public exploitFix available

    NGINX Map directive and Regex matching vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Ran

    nginxOperating systems Web servers
    • Update to 1.30.4-3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-48142

    Medium · CVSS 6.3EPSS 0.37%Fix available

    NGINX ngx_http_charset_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.1-5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-42055

    Critical · CVSS 9.2EPSS 6.54%Fix available

    NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on sys

    nginxOperating systems Web servers
    • Update to 1.30.1-5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2026-9256

    Critical · CVSS 9.2EPSS 2.7%Fix available

    NGINX ngx_http_rewrite_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute co

    nginxOperating systems Web servers
    • Update to 1.30.1-3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2026-42926

    Medium · CVSS 6.3EPSS 0.34%Fix available

    NGINX ngx_http_proxy_v2_module vulnerability

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.0-4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-40460

    Medium · CVSS 6.9EPSS 0.38%Fix available

    NGINX ngx_quic_module vulnerability

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.0-4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-42946

    High · CVSS 8.3EPSS 0.93%Fix available

    NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.0-4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-42934

    Medium · CVSS 6.3EPSS 0.73%Fix available

    NGINX ngx_http_charset_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.0-4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2026-42945

    Critical · CVSS 9.2EPSS 3.4%Public exploitFix available

    NGINX ngx_http_rewrite_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomiza

    nginxOperating systems Web servers
    • Update to 1.30.0-3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-40701

    Medium · CVSS 6.3EPSS 0.69%Fix available

    NGINX ngx_http_ssl_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.30.0-4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-27651

    High · CVSS 8.7EPSS 1.71%Fix available

    NGINX ngx_mail_auth_http_module vulnerability

    When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    nginxOperating systems Web servers
    • Update to 1.28.3-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2026-27654

    High · CVSS 8.8EPSS 25.94%Public exploitFix available

    NGINX ngx_http_dav_module vulnerability

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access t

    nginxOperating systems Web servers
    • Update to 1.28.3-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →