Back Linuxsecurity

Fedora 43 nginx Critical Update for CVE-2026-42055, 42530, 48142

Linuxsecurity •LinuxSecurity Advisories • June 27, 2026

nginx-mod-headers-more: Rebuild for 1.30.3 nginx-mod-brotli: Rebuild for 1.30.3 nginx-mod-vts: Rebuild for 1.30.3 nginx-mod-modsecurity: Rebuild for 1.30.3 nginx-mod-fancyindex: Rebuild for 1.30.3 nginx-mod-naxsi: Rebuild for 1.30.3 nginx: update to 1.30.3 fixes CVE-2026-42055, CVE-2026-42530 and CVE-2026-48142

* Wed Jun 17 2026 Felix Kaechele - 2:1.30.3-1 - update to 1.30.3 - fixes CVE-2026-42055, CVE-2026-42530 and CVE-2026-48142 * Fri Jun 12 2026 Yaakov Selkowitz - 2:1.30.2-2 - Rebuilt for openssl 4.0

Fedora Update Notification FEDORA-2026-9d7328702e 2026-06-27 00:54:50.049683+00:00 Name : nginx Product : Fedora 43 Version : 1.30.3 Release : 1.fc43 URL : Summary : A high performance web server and reverse proxy server Description : Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9d7328702e' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE Fixes Released for Fedora Nginx Modules On June 17, 2026, multiple critical vulnerabilities (CVE-2026-42055, CVE-2026-42530, CVE-2026-48142) affecting Fedora's Nginx modules were disclosed. These vulnerabilities allow for potential remote code execution and denial-of-service attacks. The affected modules include nginx-mod-fancyindex, nginx-mod-modsecurity, nginx-mod-headers-more, nginx-mod-brotli, nginx-mod-naxsi, nginx-mod-js-challenge, and nginx-mod-vts. Users of Fedora 43 and 44 are urged to update their systems immediately to mitigate these risks. The updates address the vulnerabilities and provide necessary patches. The first public proof-of-concept (PoC) for these vulnerabilities emerged on June 19, 2026, heightening the urgency for system administrators to apply the updates. As of June 27, 2026, the updates are available for installation via the 'dnf' package manager. 15 sources 73

Extracted Entities

CVEs (3)

CVE-2026-42055 CVE-2026-42530 CVE-2026-48142