nginx: Fix of CVE-2026-1642

CVE-2026-1642: detect premature plain text response from SSL backend...

Exploit for CVE-2026-61628

abraxaslabs.tech · github.com/abraxas ·&...

UBUNTU-CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

UBUNTU-CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

UBUNTU-CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

nginx 1.3.0 < 1.28.2 / 1.29.x < 1.29.5 SSL Upstream Injection

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...

CVE-2026-61629

creationtimestamp| type| source ---|---|--- 2026-09-21 22:35:04+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx 2026-09-21 23:31:26+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc 2026-09-22...

CVE-2026-61628

creationtimestamp| type| source ---|---|--- 2026-09-21 22:32:02+00:00| seen| https://gist.github.com/alon710/c22586b9d9c77f8331c17f01285d9c0d 2026-09-21 22:35:02+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5 2026-09-21...

CVE-2026-90439

A flaw was found in NGINX ngxhttpv3module. A limited heap buffer overflow can occur during a Transport Layer Security TLS handshake when using HTTP/3 with certain OpenSSL versions. This vulnerability may allow remote attackers to cause a denial-of-service DoS on the NGINX system. Additionally, it...

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

GHSA-PXCX-FV34-X9P5 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

GHSA-JR34-H97M-9HPX nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

GHSA-HF33-Q6CF-C66F nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

SUSE CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...