389142 matches found
EUVD-2026-101122
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
CVE-2026-104939 NGINX Ingress Controller vulnerability
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
CVE-2026-101019
The NGINX JavaScript (njs) module contains a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends, the $attr$Name getter may return undefined for attributes containing internal entit...
EUVD-2026-101120
Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...
CVE-2026-101019 NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
CVE-2026-95101
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...
CVE-2026-95101 NGINX ngx_http_v3_module vulnerability
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...
CVE-2026-94197 NGINX Ingress Controller vulnerability
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
EUVD-2026-101119
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...
CVE-2026-95101
A vulnerability exists in the ngx_http_v3_module module within NGINX Plus and NGINX Open Source . When utilizing HTTP/3 with the proxy_request_buffering on directive, an unauthenticated attacker can perform data injection into the proxied request. This is a data plane issue only and does not invo...
CVE-2026-95101 NGINX ngx_http_v3_module vulnerability
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...
CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
EUVD-2026-101116
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...
EUVD-2026-101114
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
CVE-2026-97629 NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-15176 NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...
CVE-2026-15176
A heap buffer overflow vulnerability exists in the ngx_http_core_module of NGINX Plus and NGINX Open Source . The flaw is triggered when a location is configured using the alias directive with rewrite , set , or return directives referencing the $request_filename variable, or alternatively, when ...
CVE-2026-97629
The ngx_http_ssl_module in NGINX Plus , NGINX Open Source , and related F5 products (such as NGINX Instance Manager , F5 WAF for NGINX , and NGINX Gateway Fabric ) is vulnerable to a session forgery flaw. When configured with ssl_session_cache shared:name:size without an explicit ssl_session_tick...
CVE-2026-15176 NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...