Skip to content
Threat Feed
Subscribe

Tag

Nginx

7 briefs RSS
critical advisory

Nginx Vulnerability Leading to Remote Code Execution and Denial of Service

A vulnerability in Nginx allows a remote attacker to execute arbitrary code and cause a denial-of-service condition, affecting Nginx Open Source versions 1.x before 1.30.2, versions after 1.31.0 before 1.31.1, Nginx Plus versions 37.x before 37.0.1.1, and versions Rx before R36 P5 or R32 P7.

NGINX Open Source +1 nginx rce dos CVE-2026-9256 webserver
2r 2t
high threat

NGINX Open Source and NGINX Plus Vulnerability Allows Denial of Service and Potential Code Execution

A remote, anonymous attacker can exploit a vulnerability in NGINX Open Source and NGINX Plus to perform a denial-of-service attack and potentially execute arbitrary code.

NGINX Open Source +1 nginx denial-of-service code-execution
2r 1t
high advisory

NGINX JavaScript Heap Buffer Overflow Vulnerability (CVE-2026-8711)

NGINX JavaScript is vulnerable to a heap buffer overflow (CVE-2026-8711) when the js_fetch_proxy directive is configured with client-controlled variables and ngx.fetch(), allowing unauthenticated attackers to cause worker process restarts or, with ASLR disabled, code execution via crafted HTTP requests.

NGINX JavaScript cve heap-buffer-overflow nginx
2r 3t 1c
critical advisory

Multiple Vulnerabilities in NGINX Open Source and NGINX Plus

Multiple vulnerabilities in NGINX Open Source and NGINX Plus allow a remote, anonymous attacker to bypass security measures, execute arbitrary code, manipulate data, disclose confidential information, or cause a denial-of-service condition.

nginx open source +1 nginx vulnerability webserver
2r 8t
high threat

CVE-2026-42945: NGINX ngx_http_rewrite_module Heap Buffer Overflow

NGINX Plus and NGINX Open Source are vulnerable to a heap buffer overflow (CVE-2026-42945) due to crafted HTTP requests when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed PCRE capture with a replacement string that includes a question mark, potentially leading to denial of service or code execution.

NGINX Plus +1 cve CVE-2026-42945 nginx heap overflow denial of service webserver
2r 3t 1c
critical advisory

Multiple Vulnerabilities in NGINX and NGINX Plus

Multiple vulnerabilities in NGINX Plus and NGINX can be exploited by an attacker to perform a denial of service attack, manipulate data, bypass security measures, and potentially execute arbitrary program code, leading to significant impact.

nginx vulnerability denial-of-service code-execution webserver linux
2r 1t
high advisory

NGINX ngx_mail_auth_http_module Denial-of-Service Vulnerability (CVE-2026-27651)

NGINX Plus and NGINX Open Source are vulnerable to a denial-of-service condition (CVE-2026-27651) when the ngx_mail_auth_http_module is enabled, CRAM-MD5 or APOP authentication is used, and the authentication server permits retry via the Auth-Wait response header, leading to worker process termination.

nginx denial-of-service mail proxy cve-2026-27651
2r 2t