Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

18 records

Vendor: F5 Component: Nginx Gateway Fabric Clear all filters
TI-2026-42786 CVE-2026-60005 · GHSA-vxcv-h5wj-jxr5

NGINX ngx_http_slice_module vulnerability

Priority MEDIUM 45

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0074 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-908
TI-2026-42806 CVE-2026-60065 · GHSA-w94h-5qpm-994v

NGINX Plus ngx_stream_mqtt_filter_module vulnerability

Priority LOW 28

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00448 Published 2026-07-15 Fixed in 37.0.3.1, R36 P7 CWE-125
TI-2026-40780 CVE-2026-56434 · GHSA-m73p-xg7q-m8f2

NGINX ngx_http_ssi_module vulnerability

Priority LOW 37

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00486 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-416
TI-2026-30813 CVE-2026-42533 · GHSA-fxfg-v4rj-hp95

NGINX Map directive and Regex matching vulnerability

Priority HIGH 75

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.06296 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-122
TI-2026-25174 CVE-2026-32682 · GHSA-vh3x-jr27-wpwh

NGINX Gateway Fabric vulnerability

Priority LOW 31

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00292 Published 2026-06-17 Fixed in 2.6.4 CWE-129
TI-2026-36891 CVE-2026-50107 · GHSA-gx48-gh32-62q5

NGINX Gateway Fabric vulnerability

Priority MEDIUM 40

When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00492 Published 2026-06-17 Fixed in 2.6.4 CWE-74
TI-2026-09769 CVE-2026-11311 · GHSA-9566-3h6w-56pp

NGINX Gateway Fabric vulnerability

Priority MEDIUM 40

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00567 Published 2026-06-17 Fixed in 2.6.4 CWE-76
TI-2026-35579 CVE-2026-48142 · GHSA-2388-jp8v-fg9w

NGINX ngx_http_charset_module vulnerability

Priority LOW 29

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00684 Published 2026-06-17 Partial fix · 1.31.2, 1.30.3 +2 CWE-125
TI-2026-30812 CVE-2026-42530 · GHSA-5mcp-3252-f5vr

NGINX Open-Source ngx_http_v3_module vulnerability

Priority MEDIUM 51

NGINX Open Source has a vulnerability in the ngx_http_v3_module module.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.06218 Published 2026-06-17 Fixed in 1.31.2 CWE-416
TI-2026-08132 CVE-2026-9256 · GHSA-h78r-86c6-jgp4

NGINX ngx_http_rewrite_module vulnerability

Priority MEDIUM 55

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.10856 Published 2026-05-22 Partial fix · 37.0.1.1, R36 P5 +3 CWE-122
TI-2026-31125 CVE-2026-42926 · GHSA-v43f-895r-chhh

NGINX ngx_http_proxy_v2_module vulnerability

Priority LOW 34

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00346 Published 2026-05-13 Partial fix · 1.31.0, 1.30.1 CWE-172
TI-2026-29212 CVE-2026-40460 · GHSA-h7rq-f9gq-mc8r

NGINX ngx_quic_module vulnerability

Priority LOW 37

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00373 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-290
TI-2026-31137 CVE-2026-42946 · GHSA-fm65-xrrr-c358

NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability

Priority LOW 38

A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00932 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-789
TI-2026-31131 CVE-2026-42934 · GHSA-6vmc-2wh4-77qp

NGINX ngx_http_charset_module vulnerability

Priority LOW 29

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00731 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-125
TI-2026-31136 CVE-2026-42945 · GHSA-gcgv-v5gf-c543

NGINX ngx_http_rewrite_module vulnerability

Priority HIGH 78

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.68047 Published 2026-05-13 Fixed in R37, R36 P4 +3 CWE-122
TI-2026-29378 CVE-2026-40701 · GHSA-x88q-x2r7-vg3g

NGINX ngx_http_ssl_module vulnerability

Priority LOW 29

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0069 Published 2026-05-13 Partial fix · R37, R36 P4 +3 CWE-416
TI-2026-01327 CVE-2026-1642 · GHSA-7chh-rv6q-8pp3

NGINX vulnerability

Priority LOW 36

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0038 Published 2026-02-04 Partial fix · 1.29.5, R36 P2 +2 CWE-349