Nginx Open Source (F5) - vulnerabilities (CVEs)

35 CVEs, 5 in the last 30 days, 506 known versions, newest CVE from 2026-10-14. Vendor: F5.

CVEs of Nginx Open Source

• CVE-2026-95101 - CVSS 6.9 (medium), 2026-10-14: Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering…
• CVE-2026-93479 - CVSS 9.2 (critical), 2026-10-14: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the…
• CVE-2026-97205 - CVSS 9.2 (critical), 2026-10-14: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain…
• CVE-2026-97629 - CVSS 8.3 (high), 2026-10-14: Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key…
• CVE-2026-15176 - CVSS 9.2 (critical), 2026-10-14: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or…
• CVE-2026-90439 - CVSS 6.9 (medium), 2026-09-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain…
• CVE-2026-60005 - CVSS 8.8 (high), 2026-07-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured…
• CVE-2026-56434 - CVSS 8.3 (high), 2026-07-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI),…
• CVE-2026-42533 - CVSS 9.2 (critical), 2026-07-15: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture…
• CVE-2026-48142 - CVSS 6.3 (medium), 2026-06-17: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with…
• CVE-2026-42530 - CVSS 9.2 (critical), 2026-06-17: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote…
• CVE-2026-42055 - CVSS 9.2 (critical), 2026-06-17: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the…
• CVE-2026-9256 - CVSS 9.2 (critical), 2026-05-22: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex…
• CVE-2026-42946 - CVSS 8.3 (high), 2026-05-13: A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.…
• CVE-2026-42945 - CVSS 9.2 (critical), 2026-05-13: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed…
• CVE-2026-42926 - CVSS 6.3 (medium), 2026-05-13: When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to…
• CVE-2026-42934 - CVSS 6.3 (medium), 2026-05-13: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with…
• CVE-2026-40701 - CVSS 6.3 (medium), 2026-05-13: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and…
• CVE-2026-40460 - CVSS 6.9 (medium), 2026-05-13: When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for…
• CVE-2026-32647 - CVSS 8.5 (high), 2026-03-24: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or…
• CVE-2026-27784 - CVSS 8.5 (high), 2026-03-24: The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write…
• CVE-2026-27654 - CVSS 8.8 (high), 2026-03-24: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX…
• CVE-2026-28755 - CVSS 5.4 (medium), 2026-03-24: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured…
• CVE-2026-28753 - CVSS 6.3 (medium), 2026-03-24: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This…
• CVE-2026-27651 - CVSS 8.7 (high), 2026-03-24: When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This…
• CVE-2026-1642 - CVSS 8.2 (high), 2026-02-04: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a…
• CVE-2025-53859 - CVSS 6.3 (medium), 2025-08-13: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP…
• CVE-2025-23419 - CVSS 5.3 (medium), 2025-02-05: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate…
• CVE-2024-7347 - CVSS 5.7 (medium), 2024-08-14: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in…
• CVE-2024-35200 - CVSS 5.3 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.
• CVE-2024-34161 - CVSS 5.3 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or…
• CVE-2024-32760 - CVSS 6.5 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to…
• CVE-2024-31079 - CVSS 4.8 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or…
• CVE-2024-24990 - CVSS 7.5 (high), 2024-02-14: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The…
• CVE-2024-24989 - CVSS 7.5 (high), 2024-02-14: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The…