Vendor
Nginx
43 known vulnerabilities in products by Nginx, 0 of them actively exploited (CISA KEV).
Key figures
43
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-9256 | NGINX ngx_http_rewrite_module vulnerability | 8.1 | |
| Critical | CVE-2026-42945 | NGINX ngx_http_rewrite_module vulnerability | 8.1 | |
| Critical | CVE-2026-42055 | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | 8.1 | |
| Critical | CVE-2026-42530 | NGINX Open-Source ngx_http_v3_module vulnerability | 8.1 | |
| High | CVE-2017-7529 | Nginx: Integer Overflow or Wraparound | 7.5 | |
| Critical | CVE-2026-93479 | NGINX map directive and regex matching vulnerability | 8.1 | |
| Critical | CVE-2021-46461 | Nginx Njs: Out-of-Bounds Access | 9.8 | |
| Medium | CVE-2025-23419 | TLS Session Resumption Vulnerability | 4.3 | |
| Critical | CVE-2026-15176 | NGINX ngx_http_core_module vulnerability | 8.1 | |
| Critical | CVE-2026-97205 | NGINX ngx_http_core_module vulnerability | 8.1 | |
| Critical | CVE-2026-42533 | NGINX Map directive and Regex matching vulnerability | 8.1 | |
| Medium | CVE-2011-4968 | Nginx: security vulnerability | 4.8 | |
| High | CVE-2026-42946 | NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability | 7.4 | |
| High | CVE-2026-91184 | NGINX Gateway Fabric vulnerability | 8.8 | |
| High | CVE-2026-94197 | NGINX Ingress Controller vulnerability | 7.5 | |
| High | CVE-2026-104939 | NGINX Ingress Controller vulnerability | 7.5 | |
| High | CVE-2026-60005 | NGINX ngx_http_slice_module vulnerability | 8.2 | |
| High | CVE-2022-35173 | Nginx Njs: security vulnerability | 7.5 | |
| High | CVE-2026-11311 | NGINX Gateway Fabric vulnerability | 6.5 | |
| High | CVE-2026-1642 | NGINX vulnerability | 5.9 | |
| High | CVE-2026-50107 | NGINX Gateway Fabric vulnerability | 8.1 | |
| Not rated | CVE-2009-3898 | F5 NGINX: Path Traversal | — | |
| Not rated | CVE-2009-3896 | F5 NGINX: NULL Pointer Dereference | — | |
| High | CVE-2026-97629 | NGINX ngx_http_ssl_module vulnerability | 6.5 | |
| High | CVE-2026-56434 | NGINX ngx_http_ssi_module vulnerability | 6.5 |
News
- F5 rushes out emergency NGINX patches for three critical flawscsoonline,
- 17 old software bugs that took way too long to squashcsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29sans-atrisk-mail,
- Health-ISAC Warns of Increased Attacks from ShinyHunters Threat Actorssans-newsbites-mail,
- Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Executionthehackernews,
Products
| Nginx Plus | 23 | 0 |
| Nginx Open Source | 17 | 0 |
| Nginx | 13 | 0 |
| Nginx Gateway Fabric | 13 | 0 |
| Nginx Ingress Controller | 7 | 0 |
| Nginx Javascript (njs) | 7 | 0 |
| Nginx F5 Dos | 5 | 0 |
| Nginx F5 Waf | 5 | 0 |
| Nginx Instance Manager | 5 | 0 |
| Njs | 5 | 0 |