nginx security advisories

All nginx security issues should be reported via one of the methods listed here.
Patches are signed using one of the PGP public keys.
Buffer overflow when using alias with rewriteSeverity: mediumAdvisoryCVE-2026-15176Not vulnerable: 1.31.7+, 1.30.6+Vulnerable: 0.1.29-1.31.6
Buffer overflow in script evaluationSeverity: mediumAdvisoryCVE-2026-93479Not vulnerable: 1.31.7+, 1.30.6+Vulnerable: 1.31.2-1.31.6, 1.30.0-1.30.5
Request body injection in HTTP/3Severity: mediumAdvisoryCVE-2026-95101Not vulnerable: 1.31.7+, 1.30.6+Vulnerable: 1.25.0-1.31.6
Session forgery when using TLS session ticketsSeverity: mediumAdvisoryCVE-2026-97629Not vulnerable: 1.31.7+, 1.30.6+Vulnerable: 1.23.2-1.31.6
Use-after-free when using asynchronous file I/O (AIO)Severity: mediumAdvisoryCVE-2026-97205Not vulnerable: 1.31.7+, 1.30.6+Vulnerable: 0.8.11-1.31.6
Buffer overflow when using ngx_http_v3_moduleSeverity: mediumAdvisoryCVE-2026-90439Not vulnerable: 1.31.6+, 1.30.5+Vulnerable: 1.29.2-1.31.5
Buffer overflow when using map and regexSeverity: majorAdvisoryCVE-2026-42533Not vulnerable: 1.31.3+, 1.30.4+Vulnerable: 0.9.6-1.31.2
Memory disclosure when using ngx_http_slice_moduleSeverity: mediumAdvisoryCVE-2026-60005Not vulnerable: 1.31.3+, 1.30.4+Vulnerable: 1.15.8-1.31.2
Use-after-free when using ngx_http_ssi_moduleSeverity: mediumAdvisoryCVE-2026-56434Not vulnerable: 1.31.3+, 1.30.4+Vulnerable: 0.8.11-1.31.2
Use-after-free in HTTP/3Severity: majorAdvisoryCVE-2026-42530Not vulnerable: 1.31.2+Vulnerable: 1.31.0-1.31.1
Buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_moduleSeverity: mediumAdvisoryCVE-2026-42055Not vulnerable: 1.31.2+, 1.30.3+Vulnerable: 1.13.10-1.31.1
Buffer overread in the ngx_http_charset_moduleSeverity: lowAdvisoryCVE-2026-48142Not vulnerable: 1.31.2+, 1.30.3+Vulnerable: 0.3.50-1.31.1
Buffer overflow in the ngx_http_rewrite_moduleSeverity: mediumAdvisoryCVE-2026-9256Not vulnerable: 1.31.1+, 1.30.2+Vulnerable: 0.1.17-1.31.0
HTTP/2 request injection in the ngx_http_proxy_moduleSeverity: mediumAdvisoryCVE-2026-42926Not vulnerable: 1.31.0+, 1.30.1+Vulnerable: 1.29.4-1.30.0
Buffer overflow in the ngx_http_rewrite_moduleSeverity: mediumAdvisoryCVE-2026-42945Not vulnerable: 1.31.0+, 1.30.1+Vulnerable: 0.6.27-1.30.0
Buffer overread in the ngx_http_scgi_module and ngx_http_uwsgi_moduleSeverity: mediumAdvisoryCVE-2026-42946Not vulnerable: 1.31.0+, 1.30.1+Vulnerable: 0.8.42-1.30.0
Buffer overread in the ngx_http_charset_moduleSeverity: lowAdvisoryCVE-2026-42934Not vulnerable: 1.31.0+, 1.30.1+Vulnerable: 0.3.50-1.30.0
HTTP/3 address spoofingSeverity: mediumAdvisoryCVE-2026-40460Not vulnerable: 1.31.0+, 1.30.1+Vulnerable: 1.25.0-1.30.0
resolver use-after-free in OCSPSeverity: mediumAdvisoryCVE-2026-40701Not vulnerable: 1.31.0+, 1.30.1+Vulnerable: 1.19.0-1.30.0
Buffer overflow in ngx_http_dav_moduleSeverity: mediumAdvisoryCVE-2026-27654Not vulnerable: 1.29.7+, 1.28.3+Vulnerable: 0.5.13-1.29.6
Buffer overflow in the ngx_http_mp4_moduleSeverity: mediumAdvisoryCVE-2026-27784Not vulnerable: 1.29.7+, 1.28.3+Vulnerable: 1.1.19-1.29.6
Buffer overflow in the ngx_http_mp4_moduleSeverity: mediumAdvisoryCVE-2026-32647Not vulnerable: 1.29.7+, 1.28.3+Vulnerable: 1.1.19-1.29.6
NULL pointer dereference while using CRAM-MD5 or APOPSeverity: lowAdvisoryCVE-2026-27651Not vulnerable: 1.29.7+, 1.28.3+Vulnerable: 0.5.15-1.29.6
Injection in auth_http and XCLIENTSeverity: mediumAdvisoryCVE-2026-28753Not vulnerable: 1.29.7+, 1.28.3+Vulnerable: 0.6.27-1.29.6
OCSP result bypass in streamSeverity: mediumAdvisoryCVE-2026-28755Not vulnerable: 1.29.7+, 1.28.3+Vulnerable: 1.27.2-1.29.6
SSL upstream injectionSeverity: mediumAdvisoryCVE-2026-1642Not vulnerable: 1.29.5+, 1.28.2+Vulnerable: 1.3.0-1.29.4
Buffer overread in the ngx_mail_smtp_moduleSeverity: lowAdvisoryCVE-2025-53859Not vulnerable: 1.29.1+Vulnerable: 0.7.22-1.29.0
SSL session reuse vulnerabilitySeverity: mediumAdvisoryCVE-2025-23419Not vulnerable: 1.27.4+, 1.26.3+Vulnerable: 1.11.4-1.27.3
Buffer overread in the ngx_http_mp4_moduleSeverity: lowAdvisoryCVE-2024-7347Not vulnerable: 1.27.1+, 1.26.2+Vulnerable: 1.5.13-1.27.0The patch pgp
Buffer overwrite in HTTP/3Severity: mediumAdvisoryCVE-2024-32760Not vulnerable: 1.27.0+, 1.26.1+Vulnerable: 1.25.0-1.25.5, 1.26.0
Stack overflow and use-after-free in HTTP/3Severity: mediumAdvisoryCVE-2024-31079Not vulnerable: 1.27.0+, 1.26.1+Vulnerable: 1.25.0-1.25.5, 1.26.0
NULL pointer dereference in HTTP/3Severity: mediumAdvisoryCVE-2024-35200Not vulnerable: 1.27.0+, 1.26.1+Vulnerable: 1.25.0-1.25.5, 1.26.0
Memory disclosure in HTTP/3Severity: mediumAdvisoryCVE-2024-34161Not vulnerable: 1.27.0+, 1.26.1+Vulnerable: 1.25.0-1.25.5, 1.26.0
NULL pointer dereference in HTTP/3Severity: majorAdvisoryCVE-2024-24989Not vulnerable: 1.25.4+Vulnerable: 1.25.3
Use-after-free in HTTP/3Severity: majorAdvisoryCVE-2024-24990Not vulnerable: 1.25.4+Vulnerable: 1.25.0-1.25.3
Memory corruption in the ngx_http_mp4_moduleSeverity: mediumAdvisoryCVE-2022-41741Not vulnerable: 1.23.2+, 1.22.1+Vulnerable: 1.1.3-1.23.1, 1.0.7-1.0.15The patch pgp
Memory disclosure in the ngx_http_mp4_moduleSeverity: mediumAdvisoryCVE-2022-41742Not vulnerable: 1.23.2+, 1.22.1+Vulnerable: 1.1.3-1.23.1, 1.0.7-1.0.15The patch pgp
1-byte memory overwrite in resolverSeverity: mediumAdvisoryCVE-2021-23017Not vulnerable: 1.21.0+, 1.20.1+Vulnerable: 0.6.18-1.20.0The patch pgp