nginx-cve-2026-42945

CVE-2026-42945 NGINX Rift — 防御用スキャナー NGINX Open Source 、NGINX Plus 、または NGINX ベースの ingress/controller を実行している組織は、CVE-2026-42945 の影響を受けているか確認し、エクスプロイトが本番環境に到達する前にパッチ適用または再設定を行うべきです。 このリポジトリは、所有またはテスト許可を得たシステム上での認可された防御目的のための読み取り専用、非エクスプロイト スキャナーを提供します。 脆弱性の概要 項目| 詳細 ---|--- CVE| CVE-2026-42945 Nam...

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

nginx 1.3.0 < 1.28.2 / 1.29.x < 1.29.5 SSL Upstream Injection

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...

CVE-2026-90439: Heap-based Buffer Overflow

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

ROS-20260810-73-0013

The vulnerabilities of the ngxhttpproxyv2module and ngxhttpgrpcmodule modules in NGINX Plus and NGINX Open Source web servers are related to the execution of operations outside of the buffer in memory. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code or cause...

Important: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

ROS-20260803-73-0011

The vulnerability of the ngxhttpssimodule module in NGINX Plus and NGINX Open Source HTTP servers relates to the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to modify the memory contents of the working process or cause service failures...

Exploit for Incorrect Authorization in F5 Nginx_Plus

🛡️ NGINX 2026 Multi-CVE CTI Investigation CVE-2026-28755...

PT-2026-65034

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http proxy v2 module and ngx http grpc module modules. This vulnerability exists when the proxy http version to 2 or grpc pass directives are used to proxy HTTP/2 traffic, the ignore invalid headers directive is set to off, and the...

Vulnerability of the ngx_http_slice_module in NGINX Plus and NGINX Open Source servers, allowing attackers to expose protected information or cause service failures.

The vulnerability of the ngxhttpslicemodule in NGINX Plus and NGINX Open Source is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failures...

GHSA-VXCV-H5WJ-JXR5 vulnerabilities

Vulnerabilities for packages: nginx-mainline, commercial-nginx-plus, nginx-stable...

GHSA-FXFG-V4RJ-HP95 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips, nginx-mainline, commercial-nginx-plus, nginx-stable...

CVE-2026-60005 vulnerabilities

Vulnerabilities for packages: nginx-mainline, commercial-nginx-plus, nginx-stable...

GHSA-M73P-XG7Q-M8F2 vulnerabilities

Vulnerabilities for packages: nginx-mainline, commercial-nginx-plus, nginx-stable...

CVE-2026-42533 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips, nginx-mainline, commercial-nginx-plus, nginx-stable...

CVE-2026-56434 vulnerabilities

Vulnerabilities for packages: nginx-mainline, commercial-nginx-plus, nginx-stable...

SUSE CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

SUSE CVE-2026-60065

When NGINX Plus is configured to use the Message Queuing Telemetry Transport MQTT filter module ngxstreammqttfiltermodule, unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart...

UBUNTU-CVE-2026-42533

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

UBUNTU-CVE-2026-60005

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...