Vulnerability

CERT-In Vulnerability Note CIVN-2026-0168
Multiple Vulnerabilities in NGINX

Original Issue Date:April 01, 2026

Severity Rating: HIGH

Software Affected

NGINX Open Source versions 1.0.0 to 1.29.6
NGINX Open Source versions 1.1.19 to 1.29.6
NGINX Open Source versions 0.5.13 to 0.9.7
NGINX Open Source versions 1.27.2 to 1.29.6
NGINX Open Source versions 0.6.27 to 0.9.7
NGINX Plus R32 - R36

Overview

Multiple vulnerabilities have been reported in NGINX Products which could allow an attacker to execute arbitrary code, cause memory corruption and trigger denial of service (DoS) condition on the targeted system.

Target Audience:
Organizations and individuals running affected versions of NGINX Open Source or NGINX Plus products.

Risk Assessment:
High risk of memory corruption, remote code execution, data manipulation.

Impact Assessment:
Potential for service disruption, memory corruption, unauthorized access.

Description

NGINX is a high-performance web server, reverse proxy, load balancer, and HTTP cache designed to handle massive, simultaneous connections with low resource usage. It acts as a fast, secure intermediary between clients and backend servers, serving static content, managing SSL/TLS encryption, and distributing traffic to optimize speed.

These vulnerabilities exist in NGINX products due to heap-based Buffer Overflow, Integer Overflow or Wraparound, Out-of-bounds Read, NULL Pointer Dereference, Incorrect Authorization, Improper Neutralization of CRLF Sequences.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause memory corruption and trigger denial of service (DoS) condition on the targeted system.

Solution

Apply appropriate security updates as mentioned in the NGINX Security Updates:
https://my.f5.com/manage/s/article/K000160336

Vendor Information

NGINX
https://my.f5.com/manage/s/article/K000160336

References

NGINX
https://my.f5.com/manage/s/article/K000160336

CVE Name
CVE-2026-27654
CVE-2026-27784
CVE-2026-32647
CVE-2026-27651
CVE-2026-28755
CVE-2026-28753

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India