Back Linuxsecurity

Fedora 44 nginx-mod-naxsi Critical Arbitrary Code Exec Vuln 2026

Linuxsecurity •LinuxSecurity Advisories • July 23, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

naxsi is an nginx module that provides score based Web Application Firewall

(WAF) abilities in a highly granular fashion.

nginx-mod-fancyindex: Rebuild for 1.30.4 nginx-mod-modsecurity: Rebuild for 1.30.4 nginx-mod-naxsi: Rebuild for 1.30.4 nginx-mod-headers-more: Rebuild for 1.30.4 nginx-mod-brotli: Rebuild for 1.30.4 nginx-mod-js-challenge: Rebuild for 1.30.4 nginx-mod-vts: Rebuild for 1.30.4 nginx: update to 1.30.4 fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434

* Sun Jul 19 2026 Felix Kaechele - 1.6-21 - Rebuild for 1.30.4 * Thu Jul 16 2026 Fedora Release Engineering - 1.6-20 - Rebuilt for

[ 1 ] Bug #2501307 - CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-60fc198d3b' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Fedora 44 NGINX Modules Require Immediate Attention Fedora 44 has released critical updates for multiple NGINX modules due to vulnerabilities identified as CVE-2026-42533, CVE-2026-60005, and CVE-2026-56434, all published on July 15, 2026. These vulnerabilities allow for arbitrary code execution via crafted HTTP requests, affecting systems running the NGINX web server. The updates address issues in modules such as nginx-mod-modsecurity, nginx-mod-headers-more, nginx-mod-naxsi, nginx-mod-brotli, and nginx-mod-vts. System administrators are urged to audit Linux privileges to limit potential compromise and escalation. The updates can be installed using the 'dnf' package manager. The first public proof of concept for CVE-2026-42533 was released on July 4, 2026, indicating a significant risk of exploitation. Immediate action is recommended to mitigate potential attacks. 12 sources 73

Extracted Entities

Fedora 44 nginx-mod-naxsi Critical Arbitrary Code Exec Vuln 2026

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

Platforms (1)

Tools (1)