Nginx security fix timeline

Public commits from nginx/nginx whose messages cite a vulnerability or a security fix. Patch text is not stored.

Nginx hub Vulnerability catalog

12 security-fix timeline events

Jul 29, 2026
Script: reserved memory overrun protection in ngx_http_script_run()
Script: reserved memory overrun protection in ngx_http_script_run() In b76754049 buffer overrun protection in script was introduced. However in ngx_http_script_run() data could still spill over to the reserved area. This had no visible effects except the return value which cou…
https://github.com/nginx/nginx/commit/6aa4b3fdd4fdc156153f2981eb4070690624447c
Jul 10, 2026
Avoid post-rewrite URI to path mapping with alias
Avoid post-rewrite URI to path mapping with alias Previously, after a "rewrite" had changed the URI, and before a new location was chosen, the new URI might not match the current location prefix. This becomes a problem when the location uses "alias", which is why normally such…
https://github.com/nginx/nginx/commit/f8a23425bd6840c4c36b4264edf576ba3646156f
May 14, 2026
Rewrite: fix buffer overflow with overlapping captures
Rewrite: fix buffer overflow with overlapping captures When the rewrite replacement string had no variables, but had overlapping captures, the length of the allocated buffer could be smaller than the replacement string. This could happen either when the "redirect" parameter is…
https://github.com/nginx/nginx/commit/ca4f92a27464ae6c2082245e4f67048c633aa032
May 14, 2026
Rewrite: harden escape flags control
Rewrite: harden escape flags control Following 2046b45aa0c6, this change introduces better control of memory allocation flags for escaped values. Notably: - The e->is_args flag is now explicitly reset on rewrite start. If the flag was set prior to rewrite start, then buffer…
https://github.com/nginx/nginx/commit/475732a3f9dfe82fc2ecdb0a7426083c9c1ee965
Mar 27, 2020
Fixed buffer overflow.
Fixed buffer overflow.
https://github.com/nginx/nginx/commit/81f7cff632d7db267be42f5451c6e1f29d021685
Jul 18, 2019
Xslt: fixed potential buffer overflow with null character.
Xslt: fixed potential buffer overflow with null character. Due to shortcomings of the ccv->zero flag implementation in complex value interface, length of the resulting string from ngx_http_complex_value() might either not include terminating null character or include it, so the…
https://github.com/nginx/nginx/commit/2187586207e1465d289ae64cedc829719a048a39
Jul 18, 2019
SSI: avoid potential buffer overflow.
SSI: avoid potential buffer overflow. When "-" follows a parameter of maximum length, a single byte buffer overflow happens, since the error branch does not check parameter length. Fix is to avoid saving "-" to the parameter key, and instead use an error message with "-" explic…
https://github.com/nginx/nginx/commit/ad42d70fed67c1e7098055fb25721ab904db2389
Aug 22, 2017
Secure link: fixed stack buffer overflow.
Secure link: fixed stack buffer overflow. When secure link checksum has length of 23 or 24 bytes, decoded base64 value could occupy 17 or 18 bytes which is more than 16 bytes previously allocated for it on stack. The buffer overflow does not have any security implications sinc…
https://github.com/nginx/nginx/commit/418124e21983aa53db4d99b7fd2eb0eee7ab4be0
Jan 27, 2015
A bounds check of %N format on Windows.
A bounds check of %N format on Windows. Thanks to Joe Bialek, Adam Zabrocki and Microsoft Vulnerability Research.
https://github.com/nginx/nginx/commit/415c8ec4b4b0bc3f2cd575f33b987661cc62e87d
Apr 30, 2014
SPDY: added a debug point to the state buffer overflow protection.
SPDY: added a debug point to the state buffer overflow protection.
https://github.com/nginx/nginx/commit/3f023a419394ac82d5a8454673ac9e117856c4e4