Updated nginx packages fix security vulnerabilities

ngxhttpproxyv2module and ngxhttpgrpcmodule vulnerability. CVE-2026-42055 ngxhttpcharsetmodule vulnerability. CVE-2026-48142...

NginxRift-Poc

NGINX Rift — CVE-2026-42945 RCE proof-of-concept for CVE-20...

Fedora 45 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-d1cd8e3d25)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-d1cd8e3d25 advisory. nginx-mod-fancyindex: Rebuild for 1.30.4 nginx-mod-modsecurity: Rebuild for 1.30.4 nginx-mod-naxsi: Rebuild for 1.30.4 nginx-mod-headers-more: Rebui...

TencentOS Server 3: nginx:1.24 (TSSA-2026:0618)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0618 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 stable and 1.31.3 mainline, and in NGINX Plus 37.0.3.1; anyone on an...

NGINX ngx_http_ssi_module vulnerability

...

CVE-2026-42533

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

FreeBSD : nginx -- multiple vulnerabilities (56feeac6-8263-11f1-92ba-bc24110523fe)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 56feeac6-8263-11f1-92ba-bc24110523fe advisory. The nginx development team reports: Buffer overflow when using map and regex CVE-2026-42533...

nginx-1.31.3-1.1 on GA media (moderate)

nginx-1.31.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11295-1 Rating: moderate Cross-References: CVE-2026-42533 CVE-2026-56434 CVE-2026-60005 CVSS scores: CVE-2026-42533 SUSE : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-42533 SUSE : 9.2...

Ingress-Nginx Controller - Remote Code Execution

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

The vulnerability of the NGINX Plus and NGINX Open Source HTTP-server directives allows attackers to execute arbitrary code or cause service interruptions.

The vulnerability of the NGINX Plus and NGINX Open Source HTTP-server directives is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure by sending a specially crafted HTTP request...

OPENSUSE-SU-2026:11295-1 nginx-1.31.3-1.1 on GA media

These are all security issues fixed in the nginx-1.31.3-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

SUSE CVE-2026-60005

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

CVE-2026-60005

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

UBUNTU-CVE-2026-42533

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

Linux Distros Unpatched Vulnerability : CVE-2026-60005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or wh...

Linux Distros Unpatched Vulnerability : CVE-2026-56434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass,...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1922)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1922 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives...