Vulnerabilities

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.

NGINX Open Source has a vulnerability in the ngx_http_v3_module module.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.

A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters…

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time.

NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.

NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.

NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.

Insertion of Sensitive Information into log file vulnerability in NGINX Agent.

In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization.