Back Linuxsecurity

Fedora 43: Nginx Important Memory Disclosure CVE-2025

Linuxsecurity •LinuxSecurity Advisories • January 3, 2026

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage. Update Information : Changes with nginx 1.28.1 23 Dec 2025 *) Security: processing of a specially crafted login/password when using the "none" authentication method in the ngx_mail_smtp_module might cause worker process memory disclosure to the authentication server (CVE-2025-53859). *) Bugfix: a segmentation fault might occur in a worker process if the "try_files" directive and "proxy_pass" with a URI were used. *) Bugfix: in handling "Host" and ":authority" header lines with equal values when using HTTP/2; the bug had appeared in 1.17.9. *) Bugfix: in handling "Host" header lines with a port when using HTTP/3. *) Bugfix: an XCLIENT command didn't use the xtext encoding. Thanks to Igor Morgenstern of Aisle Research. *) Bugfix: in SSL certificate caching during reconfiguration. *) Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. *) Change: the native nginx/Windows binary release is now built using W...

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and

IMAP protocols, with a strong focus on high concurrency, performance and low

Changes with nginx 1.28.1 23 Dec 2025 *) Security: processing of a specially crafted login/password when using the "none" authentication method in the ngx_mail_smtp_module might cause worker process memory disclosure to the authentication server (CVE-2025-53859). *) Bugfix: a segmentation fault might occur in a worker process if the "try_files" directive and "proxy_pass" with a URI were used. *) Bugfix: in handling "Host" and ":authority" header lines with equal values when using HTTP/2; the bug had appeared in 1.17.9. *) Bugfix: in handling "Host" header lines with a port when using HTTP/3. *) Bugfix: an XCLIENT command didn't use the xtext encoding. Thanks to Igor Morgenstern of Aisle Research. *) Bugfix: in SSL certificate caching during reconfiguration. *) Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. *) Change: the native nginx/Windows binary release is now built using W...

* Wed Dec 24 2025 Felix Kaechele - 2:1.28.1-1 - update to 1.28.1 * Thu Nov 20 2025 Lubo\u0161 Uhliarik - 2:1.28.0-5 - Remove 50x.html from the nginx-core package * Tue Sep 16 2025 Lubo\u0161 Uhliarik - 2:1.28.0-4 - Add tmpfiles.d rules for /var directories (bootc compatibility)

Fedora Update Notification FEDORA-2025-8aa169ea14 2026-01-03 00:41:36.670931+00:00 Name : nginx Product : Fedora 43 Version : 1.28.1 Release : 1.fc43 URL : Summary : A high performance web server and reverse proxy server Description : Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-8aa169ea14' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Memory Disclosure Vulnerability in Nginx CVE-2025-53859 A critical memory disclosure vulnerability (CVE-2025-53859) has been identified in Nginx's ngx_mail_smtp_module, affecting the processing of specially crafted login/password combinations using the 'none' authentication method. This issue may lead to memory disclosure to the authentication server. The vulnerability was addressed in the nginx 1.28.1 update released on December 23, 2025. 7 sources 39

Extracted Entities

CVEs (1)

CVE-2025-53859

Tools (1)

Nginx