Red Hat Security Advisory: nginx security update

Fixed packages 26

Vulnerabilities 5

• High 8.2
  CVE-2026-27654 Public exploit EPSS 26%

  NGINX ngx_http_dav_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 8.1
  CVE-2026-15176 Public exploit

  NGINX ngx_http_core_module vulnerability

  A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 14, 2026
• High 8.1
  CVE-2026-97205 Public exploit

  NGINX ngx_http_core_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 14, 2026
• High 7.8
  CVE-2026-27784

  NGINX ngx_http_mp4_module vulnerability

  The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only…

  F5 NGINX Open Source nginx nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.5
  CVE-2026-27651

  NGINX ngx_mail_auth_http_module vulnerability

  When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server …

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450785
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450791
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2552352
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2552359
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98529.json
• report
  https://access.redhat.com/security/cve/CVE-2026-15176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15176
• article
  https://my.f5.com/manage/s/article/K000162416
• report
  https://access.redhat.com/security/cve/CVE-2026-27651
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27651
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27651
• article
  https://my.f5.com/manage/s/article/K000160383
• report
  https://access.redhat.com/security/cve/CVE-2026-27654
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27654
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27654
• article
  https://my.f5.com/manage/s/article/K000160382
• report
  https://access.redhat.com/security/cve/CVE-2026-27784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27784
• article
  https://my.f5.com/manage/s/article/K000160364
• report
  https://access.redhat.com/security/cve/CVE-2026-97205
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-97205
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-97205
• article
  https://my.f5.com/manage/s/article/K000162608