Vulnerability

CERT-In Vulnerability Note CIVN-2026-0340
Multiple Vulnerabilities in NGINX

Original Issue Date:June 24, 2026

Severity Rating: HIGH

Software Affected

NGINX Open Source versions from 1.13.10 before 1.31.2, and from 1.31.0 before 1.31.2
NGINX Plus versions from 37.0 before 37.0.2.1, and from R36 before R36 P6

Overview

Multiple vulnerabilities have been reported in NGINX products that could allow a remote attacker to execute arbitrary code, disclose sensitive information, or cause denial-of-service conditions on affected systems.

Target Audience:
Organizations and individuals using affected NGINX products.

Risk Assessment:
High risk of remote code execution, denial of service, and sensitive information disclosure.

Impact Assessment:
Potential for arbitrary code execution, service disruption, information disclosure, and compromise of the affected NGINX server.

Description

NGINX is a high-performance web server, reverse proxy, load balancer, and HTTP cache designed to handle massive, simultaneous connections with low resource usage.

Multiple vulnerabilities have been reported in NGINX products due to use-after-free conditions, heap-based buffer overflows and out-of-bounds read. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted HTTP requests.

Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code, disclose sensitive information, or cause denial-of-service conditions on affected systems.

Solution

Apply appropriate updates as mentioned:
https://nginx.org/en/download.html

Vendor Information

NGINX
https://nginx.org/2026.html

References

https://nginx.org/en/download.html
https://nginx.org/2026.html

CVE Name
CVE-2026-42530
CVE-2026-48142
CVE-2026-42055

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India