Skip to content
OpenAdvisories
High WID-SEC-2026-3948 11 CVEs

NGINX: Mehrere Schwachstellen

Published Oct 14, 2026 · Updated Nov 11, 2026 · Revision 9 · de

Vendor: amazon Vendor: Debian Vendor: nginx Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux 2 Product: nginx Product: openSUSE Product: Plus Product: Rocky Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in NGINX NGINX Plus und NGINX ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

NGINX Plus ist die kommerzielle Variante von NGINX, einer Webserver-, Reverse Proxy- und E-Mail Proxy Software.
NGINX ist eine Webserver-, Reverse Proxy- und E-Mail-Proxy Software.

Vulnerabilities 11

  • High 8.8
    CVE-2026-91184

    NGINX Gateway Fabric vulnerability

    Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A na…

    F5 NGINX Gateway Fabric Network devices
  • High 8.1
    CVE-2026-15176 Public exploit

    NGINX ngx_http_core_module vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-93479

    NGINX map directive and regex matching vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same re…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-97205 Public exploit

    NGINX ngx_http_core_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-104939

    NGINX Ingress Controller vulnerability

    Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected path…

    F5 NGINX Ingress Controller Network devices
  • High 7.5
    CVE-2026-94197

    NGINX Ingress Controller vulnerability

    An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-…

    F5 NGINX Ingress Controller Network devices
  • Medium 6.5
    CVE-2026-101019

    NGINX ngx_http_js_module vulnerability

    Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Nam…

    F5 NGINX JavaScript nginx libnginx-mod-js Network devices Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2026-96615

    NGINX Gateway Fabric vulnerability

    Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may imper…

    F5 NGINX Gateway Fabric Network devices
  • Medium 6.5
    CVE-2026-97629 Public exploit

    NGINX ngx_http_ssl_module vulnerability

    Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to for…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-101025

    NGINX ngx_http_js_module vulnerability

    Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthen…

    F5 NGINX JavaScript nginx libnginx-mod-js Network devices Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-95101

    NGINX ngx_http_v3_module vulnerability

    Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnera…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #9

    Neue Updates von Red Hat aufgenommen

  2. #8

    Neue Updates von Red Hat aufgenommen

  3. #7

    Neue Updates von Ubuntu aufgenommen

  4. #6

    Neue Updates von openSUSE aufgenommen

  5. #5

    Neue Updates von Ubuntu aufgenommen

  6. #4

    Neue Updates von Amazon aufgenommen

  7. #3

    Neue Updates von Debian aufgenommen

  8. #2

    Neue Updates von Red Hat aufgenommen

  9. #1

    Initiale Fassung

References