Skip to content

Technology

Nginx vulnerabilities

nginx open source and NGINX Plus. 549 published CVES affecting Nginx, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
549
Critical
82
High
248
Medium
172
Low
14
Unscored
33
CISA KEV
1
Atom feed of Nginx alerts

Latest Nginx CVEs

Newest publication first · page 7 of 22

  2. CVE-2026-45559 Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)

    Published
    MediumCVSS 4.9 EPSS 0.23%

    Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim —...

  8. CVE-2026-40519 Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

    Published
    HighCVSS 7.7 EPSS 0.92%

    Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to...

  9. CVE-2026-49975 Apache HTTP Server: mod_http2 denial of service

    Published
    HighCVSS 7.5 EPSS 33.0%

    Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

  13. CVE-2026-9256 NGINX ngx_http_rewrite_module vulnerability

    Published
    CriticalCVSS 9.2 EPSS 10.9%

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replac...

  14. CVE-2026-8711 NGINX JavaScript vulnerability

    Published
    CriticalCVSS 9.2 EPSS 9.7%

    NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_, $arg_, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can...

  15. CVE-2026-46356 Fleet: IP spoofing allows bypassing API rate limiting

    Published
    MediumCVSS 6.9 EPSS 0.28%

    Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fl...

  16. CVE-2026-40460 NGINX ngx_quic_module vulnerability

    Published
    MediumCVSS 6.9 EPSS 0.37%

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS)...

  17. CVE-2026-42926 NGINX ngx_http_proxy_v2_module vulnerability

    Published
    MediumCVSS 6.3 EPSS 0.35%

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Suppo...

  19. CVE-2026-42934 NGINX ngx_http_charset_module vulnerability

    Published
    MediumCVSS 6.3 EPSS 0.73%

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions be...

  20. CVE-2026-40701 NGINX ngx_http_ssl_module vulnerability

    Published
    MediumCVSS 6.3 EPSS 0.69%

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an...

  21. CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerability

    Published
    CriticalCVSS 9.2 EPSS 68.0%

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2)...

  25. CVE-2026-8430 SPIP < 4.4.14 Remote Code Execution via nginx

    Published
    CriticalCVSS 9.2 EPSS 0.43%

    SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specifi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.