Security Advisories

All nginx security issues should be reported to [email protected] or via one of the methods listed here .

Patches are signed using one of the PGP public keys .

Buffer overflow when using map and regex Severity: major Advisory CVE-2026-42533 Not vulnerable: 1.31.3+, 1.30.4+ Vulnerable: 0.9.6-1.31.2

Memory disclosure when using ngx_http_slice_module Severity: medium Advisory CVE-2026-60005 Not vulnerable: 1.31.3+, 1.30.4+ Vulnerable: 1.15.8-1.31.2

Use-after-free when using ngx_http_ssi_module Severity: medium Advisory CVE-2026-56434 Not vulnerable: 1.31.3+, 1.30.4+ Vulnerable: 0.8.11-1.31.2

Use-after-free in HTTP/3 Severity: major Advisory CVE-2026-42530 Not vulnerable: 1.31.2+ Vulnerable: 1.31.0-1.31.1

Buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module Severity: medium Advisory CVE-2026-42055 Not vulnerable: 1.31.2+, 1.30.3+ Vulnerable: 1.13.10-1.31.1

Buffer overread in the ngx_http_charset_module Severity: low Advisory CVE-2026-48142 Not vulnerable: 1.31.2+, 1.30.3+ Vulnerable: 0.3.50-1.31.1

Buffer overflow in the ngx_http_rewrite_module Severity: medium Advisory CVE-2026-9256 Not vulnerable: 1.31.1+, 1.30.2+ Vulnerable: 0.1.17-1.31.0

HTTP/2 request injection in the ngx_http_proxy_module Severity: medium Advisory CVE-2026-42926 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 1.29.4-1.30.0

Buffer overflow in the ngx_http_rewrite_module Severity: medium Advisory CVE-2026-42945 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 0.6.27-1.30.0

Buffer overread in the ngx_http_scgi_module and ngx_http_uwsgi_module Severity: medium Advisory CVE-2026-42946 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 0.8.42-1.30.0

Buffer overread in the ngx_http_charset_module Severity: low Advisory CVE-2026-42934 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 0.3.50-1.30.0

HTTP/3 address spoofing Severity: medium Advisory CVE-2026-40460 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 1.25.0-1.30.0

resolver use-after-free in OCSP Severity: medium Advisory CVE-2026-40701 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 1.19.0-1.30.0

Buffer overflow in ngx_http_dav_module Severity: medium Advisory CVE-2026-27654 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 0.5.13-1.29.6

Buffer overflow in the ngx_http_mp4_module Severity: medium Advisory CVE-2026-27784 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 1.1.19-1.29.6

Buffer overflow in the ngx_http_mp4_module Severity: medium Advisory CVE-2026-32647 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 1.1.19-1.29.6

NULL pointer dereference while using CRAM-MD5 or APOP Severity: low Advisory CVE-2026-27651 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 0.5.15-1.29.6

Injection in auth_http and XCLIENT Severity: medium Advisory CVE-2026-28753 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 0.6.27-1.29.6

OCSP result bypass in stream Severity: medium Advisory CVE-2026-28755 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 1.27.2-1.29.6

SSL upstream injection Severity: medium Advisory CVE-2026-1642 Not vulnerable: 1.29.5+, 1.28.2+ Vulnerable: 1.3.0-1.29.4

Buffer overread in the ngx_mail_smtp_module Severity: low Advisory CVE-2025-53859 Not vulnerable: 1.29.1+ Vulnerable: 0.7.22-1.29.0

SSL session reuse vulnerability Severity: medium Advisory CVE-2025-23419 Not vulnerable: 1.27.4+, 1.26.3+ Vulnerable: 1.11.4-1.27.3

Buffer overread in the ngx_http_mp4_module Severity: low Advisory CVE-2024-7347 Not vulnerable: 1.27.1+, 1.26.2+ Vulnerable: 1.5.13-1.27.0 The patch pgp

Buffer overwrite in HTTP/3 Severity: medium Advisory CVE-2024-32760 Not vulnerable: 1.27.0+, 1.26.1+ Vulnerable: 1.25.0-1.25.5, 1.26.0

Stack overflow and use-after-free in HTTP/3 Severity: medium Advisory CVE-2024-31079 Not vulnerable: 1.27.0+, 1.26.1+ Vulnerable: 1.25.0-1.25.5, 1.26.0

NULL pointer dereference in HTTP/3 Severity: medium Advisory CVE-2024-35200 Not vulnerable: 1.27.0+, 1.26.1+ Vulnerable: 1.25.0-1.25.5, 1.26.0

Memory disclosure in HTTP/3 Severity: medium Advisory CVE-2024-34161 Not vulnerable: 1.27.0+, 1.26.1+ Vulnerable: 1.25.0-1.25.5, 1.26.0

NULL pointer dereference in HTTP/3 Severity: major Advisory CVE-2024-24989 Not vulnerable: 1.25.4+ Vulnerable: 1.25.3

Use-after-free in HTTP/3 Severity: major Advisory CVE-2024-24990 Not vulnerable: 1.25.4+ Vulnerable: 1.25.0-1.25.3

Memory corruption in the ngx_http_mp4_module Severity: medium Advisory CVE-2022-41741 Not vulnerable: 1.23.2+, 1.22.1+ Vulnerable: 1.1.3-1.23.1, 1.0.7-1.0.15 The patch pgp

Memory disclosure in the ngx_http_mp4_module Severity: medium Advisory CVE-2022-41742 Not vulnerable: 1.23.2+, 1.22.1+ Vulnerable: 1.1.3-1.23.1, 1.0.7-1.0.15 The patch pgp

1-byte memory overwrite in resolver Severity: medium Advisory CVE-2021-23017 Not vulnerable: 1.21.0+, 1.20.1+ Vulnerable: 0.6.18-1.20.0 The patch pgp

Excessive CPU usage in HTTP/2 with small window updates Severity: medium Advisory CVE-2019-9511 Not vulnerable: 1.17.3+, 1.16.1+ Vulnerable: 1.9.5-1.17.2

Excessive CPU usage in HTTP/2 with priority changes Severity: low Advisory CVE-2019-9513 Not vulnerable: 1.17.3+, 1.16.1+ Vulnerable: 1.9.5-1.17.2

Excessive memory usage in HTTP/2 with zero length headers Severity: low Advisory CVE-2019-9516 Not vulnerable: 1.17.3+, 1.16.1+ Vulnerable: 1.9.5-1.17.2

Excessive memory usage in HTTP/2 Severity: low Advisory CVE-2018-16843 Not vulnerable: 1.15.6+, 1.14.1+ Vulnerable: 1.9.5-1.15.5

Excessive CPU usage in HTTP/2 Severity: low Advisory CVE-2018-16844 Not vulnerable: 1.15.6+, 1.14.1+ Vulnerable: 1.9.5-1.15.5

Memory disclosure in the ngx_http_mp4_module Severity: medium Advisory CVE-2018-16845 Not vulnerable: 1.15.6+, 1.14.1+ Vulnerable: 1.1.3-1.15.5, 1.0.7-1.0.15 The patch pgp

Integer overflow in the range filter Severity: medium Advisory CVE-2017-7529 Not vulnerable: 1.13.3+, 1.12.1+ Vulnerable: 0.5.6-1.13.2 The patch pgp

NULL pointer dereference while writing client request body Severity: medium Advisory CVE-2016-4450 Not vulnerable: 1.11.1+, 1.10.1+ Vulnerable: 1.3.9-1.11.0 The patch pgp (for 1.9.13-1.11.0) The patch pgp (for 1.3.9-1.9.12)

Invalid pointer dereference in resolver Severity: medium Advisory CVE-2016-0742 Not vulnerable: 1.9.10+, 1.8.1+ Vulnerable: 0.6.18-1.9.9

Use-after-free during CNAME response processing in resolver Severity: medium Advisory CVE-2016-0746 Not vulnerable: 1.9.10+, 1.8.1+ Vulnerable: 0.6.18-1.9.9

Insufficient limits of CNAME resolution in resolver Severity: medium Advisory CVE-2016-0747 Not vulnerable: 1.9.10+, 1.8.1+ Vulnerable: 0.6.18-1.9.9

SSL session reuse vulnerability Severity: medium Advisory CVE-2014-3616 Not vulnerable: 1.7.5+, 1.6.2+ Vulnerable: 0.5.6-1.7.4

STARTTLS command injection Severity: medium Advisory CVE-2014-3556 Not vulnerable: 1.7.4+, 1.6.1+ Vulnerable: 1.5.6-1.7.3 The patch pgp

SPDY heap buffer overflow Severity: major Advisory CVE-2014-0133 Not vulnerable: 1.5.12+, 1.4.7+ Vulnerable: 1.3.15-1.5.11 The patch pgp

SPDY memory corruption Severity: major Advisory CVE-2014-0088 Not vulnerable: 1.5.11+ Vulnerable: 1.5.10 The patch pgp

Request line parsing vulnerability Severity: medium Advisory CVE-2013-4547 Not vulnerable: 1.5.7+, 1.4.4+ Vulnerable: 0.8.41-1.5.6 The patch pgp

Memory disclosure with specially crafted HTTP backend responses Severity: medium Advisory CVE-2013-2070 Not vulnerable: 1.5.0+, 1.4.1+, 1.2.9+ Vulnerable: 1.1.4-1.2.8, 1.3.9-1.4.0 The patch pgp (for 1.3.9-1.4.0) The patch pgp (for 1.1.4-1.2.8)

Stack-based buffer overflow with specially crafted request Severity: major Advisory CVE-2013-2028 Not vulnerable: 1.5.0+, 1.4.1+ Vulnerable: 1.3.9-1.4.0 The patch pgp

Vulnerabilities with Windows directory aliases Severity: medium Advisory CVE-2011-4963 Not vulnerable: 1.3.1+, 1.2.1+ Vulnerable: nginx/Windows 0.7.52-1.3.0

Buffer overflow in the ngx_http_mp4_module Severity: major Advisory CVE-2012-2089 Not vulnerable: 1.1.19+, 1.0.15+ Vulnerable: 1.1.3-1.1.18, 1.0.7-1.0.14 The patch pgp

Memory disclosure with specially crafted backend responses Severity: major Advisory CVE-2012-1180 Not vulnerable: 1.1.17+, 1.0.14+ Vulnerable: 0.1.0-1.1.16 The patch pgp

Buffer overflow in resolver Severity: medium CVE-2011-4315 Not vulnerable: 1.1.8+, 1.0.10+ Vulnerable: 0.6.18-1.1.7

Vulnerabilities with invalid UTF-8 sequence on Windows Severity: major CVE-2010-2266 Not vulnerable: 0.8.41+, 0.7.67+ Vulnerable: nginx/Windows 0.7.52-0.8.40

Vulnerabilities with Windows file default stream Severity: major CVE-2010-2263 Not vulnerable: 0.8.40+, 0.7.66+ Vulnerable: nginx/Windows 0.7.52-0.8.39

Vulnerabilities with Windows 8.3 filename pseudonyms Severity: major CORE-2010-0121 Not vulnerable: 0.8.33+, 0.7.65+ Vulnerable: nginx/Windows 0.7.52-0.8.32

An error log data are not sanitized Severity: none CVE-2009-4487 Not vulnerable: none Vulnerable: all

The renegotiation vulnerability in SSL protocol Severity: major VU#120541 CVE-2009-3555 Not vulnerable: 0.8.23+, 0.7.64+ Vulnerable: 0.1.0-0.8.22 The patch pgp

Directory traversal vulnerability Severity: minor CVE-2009-3898 Not vulnerable: 0.8.17+, 0.7.63+ Vulnerable: 0.1.0-0.8.16

Buffer underflow vulnerability Severity: major VU#180065 CVE-2009-2629 Not vulnerable: 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+ Vulnerable: 0.1.0-0.8.14 The patch pgp

Null pointer dereference vulnerability Severity: major CVE-2009-3896 Not vulnerable: 0.8.14+, 0.7.62+, 0.6.39+, 0.5.38+ Vulnerable: 0.1.0-0.8.13 The patch pgp