Nginx security note

CVE-2025-13516 — Open the advisory

The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0.

Affected: <= 1.9.0

CVE-2025-11379 — Open the advisory

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9.

Affected: <= 0.25.9

CVE-2026-97629 — Check if you run it

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically r

Affected: 1.22.1-9, 1.22.1-9+deb12u1, 1.22.1-9+deb12u10, 1.26.3-3

CVE-2026-97205 — Check if you run it

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.

Affected: 1.22.1-9, 1.22.1-9+deb12u1, 1.22.1-9+deb12u10, 1.26.3-3

CVE-2026-93479 — Check if you run it

NGINX map directive and regex matching vulnerability

Affected: 1.22.1-9, 1.22.1-9+deb12u1, 1.22.1-9+deb12u10, 1.26.3-3

CVE-2026-95101 — Check if you run it

NGINX ngx_http_v3_module vulnerability

Affected: 1.22.1-9, 1.22.1-9+deb12u1, 1.22.1-9+deb12u10, 1.26.3-3

AZL-108443 — Open the advisory

CVE-2026-97205 affecting package nginx 1.30.4-1

Affected: 0 → 1.30.4-1

openSUSE-SU-2026:12143-1 — Open the advisory

nginx-1.31.7-1.1 on GA media

Affected: 0 → 1.31.7-1.1

CVE-2026-109326 — Open the advisory

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root.

No version range is stored, so an installed version cannot be checked.

CVE-2026-84312 — Check if you run it

Nginx UI is a web user interface for the Nginx web server.

No version range is stored, so an installed version cannot be checked.

CVE-2026-96615 — Check if you run it

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.

No version range is stored, so an installed version cannot be checked.

CVE-2026-94197 — Check if you run it

An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.

No version range is stored, so an installed version cannot be checked.

CVE-2026-104939 — Check if you run it

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAut

No version range is stored, so an installed version cannot be checked.

CVE-2026-101025 — Check if you run it

Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanu

No version range is stored, so an installed version cannot be checked.

CVE-2026-101019 — Check if you run it

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built

No version range is stored, so an installed version cannot be checked.

CVE-2026-91184 — Check if you run it

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and un

No version range is stored, so an installed version cannot be checked.