The vulnerability of the ngx_http_ssl_module module in NGINX Plus and NGINX Open Source web servers allows attackers to compromise the confidentiality and accessibility of protected information.

🗓️ 18 May 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Vulnerability in ngx_http_ssl_module on NGINX Plus and Open Source enables data exposure via memory after deallocation.

Reporter	Title	Published	Views	Family All 94
FreeBSD	nginx-devel -- multiple vulnerabilities	13 May 202600:00	–	freebsd
FreeBSD	www/nginx -- Remote Code Execution/DoS	14 May 202600:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1714)	27 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-012 (ALASNGINX1-2026-012)	27 May 202600:00	–	nessus
Tenable Nessus	Debian dla-4589 : libnginx-mod-http-auth-pam - security update	18 May 202600:00	–	nessus
Tenable Nessus	Debian dsa-6278 : libnginx-mod-http-geoip - security update	16 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)	15 May 202600:00	–	nessus
Tenable Nessus	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-38623b4fed)	15 May 202600:00	–	nessus
Tenable Nessus	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-fb53cb4d67)	15 May 202600:00	–	nessus
Tenable Nessus	FreeBSD : nginx-devel -- multiple vulnerabilities (1ed77d8e-53bb-11f1-b339-3497f65b111b)	20 May 202600:00	–	nessus

Vulners

Node

nginx nginx_instance_managerRange2.16.0–2.21.1

OR

nginx f5_waf_for_nginxRange5.9.0–5.12.1

OR

nginx nginx_app_protect_wafRange5.1.0–5.8.0

OR

nginx nginx_app_protect_wafRange4.9.0–4.16.0

OR

nginx f5_dos_for_nginxMatch4.8.0

OR

nginx nginx_app_protect_dosRange4.3.0–4.7.0

OR

nginx nginx_gateway_fabricRange2.0.0–2.5.1

OR

nginx nginx_gateway_fabricRange1.3.0–1.6.2

OR

nginx nginx_ingress_controllerRange5.0.0–5.4.1

OR

nginx nginx_ingress_controllerRange4.0.0–4.0.1

OR

nginx nginx_ingress_controllerRange3.5.0–3.7.2

OR

nginx nginx_open_sourceRange1.19.0–1.31.0

OR

nginx nginx_open_sourceRange1.19.0–1.30.1

Source	Link
my	www.my.f5.com/manage/s/article/K000161021
angie	www.angie.software/angie/docs/pro_changes/
angie	www.angie.software/angie/docs/oss_changes/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
redos	www.redos.red-soft.ru/search/
web	www.web.nvd.nist.gov/view/vuln/detail

07 Jul 2026 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24

CVSS 34.8

EPSS0.00677

ngx_http_ssl_module nginx plus open source memory after deallocation data exposure