Red Hat Security AdvisoryRHSA-2026:93467
nginx security update
Released 2026-11-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.9.6) nginx-mod-devel-2:1.20.1-22.el9_6.7
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nginx-2:1.20.1-22.el9_6.7, nginx-all-modules-2:1.20.1-22.el9_6.7, nginx-core-2:1.20.1-22.el9_6.7 +6
Fixes 5 records
Priority HIGH 75
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.06296 · Published 2026-07-15 · Partial fix · 37.0.3.1, R36 P7 +2 CWE-122
Priority MEDIUM 55
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.10856 · Published 2026-05-22 · Partial fix · 37.0.1.1, R36 P5 +3 CWE-122
Priority MEDIUM 51
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.06537 · Published 2026-06-17 · Fixed in 1.31.2, 1.30.3 +2 CWE-122
Priority MEDIUM 45
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.0074 · Published 2026-07-15 · Partial fix · 37.0.3.1, R36 P7 +2 CWE-908
Priority LOW 37
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00486 · Published 2026-07-15 · Partial fix · 37.0.3.1, R36 P7 +2 CWE-416
THREATIST.IORead the docs