Red Hat Security Advisory

RHSA-2026:67283

nginx:1.26 security update

Released 2026-09-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) nginx-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.aarch64::nginx:1.26, nginx-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le::nginx:1.26, nginx-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.s390x::nginx:1.26 +32

Fixes 1 record

TI-2026-30813 CVE-2026-42533 · GHSA-fxfg-v4rj-hp95

NGINX Map directive and Regex matching vulnerability

HIGH 75

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.06296 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-122