This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · nginx

nginx Vulnerabilities

The latest security flaws in nginx, the web server and reverse proxy in front of a third of the web, and whether your version is affected.

New flaws, 30 days
1
Critical, 8 weeks
0
On CISA's exploited list
0
Latest exploited
None

Run nginx -v on the server. Many sites also show it in the Server header.

nginx Security in Short

nginx has fewer flaws than most web servers, and most of them are in optional modules (HTTP/3, mp4, the resolver), so whether one affects you often depends on your configuration. Many servers run the version their distribution shipped years ago, with fixes added by the distribution.

How to Keep nginx Patched

  • Update through your distribution or nginx's own repository, then sudo nginx -t && sudo systemctl reload nginx.
  • Hide the version number: server_tokens off; in the http block. It doesn't fix anything, but scanners look for it.
  • After an advisory, check whether you use the affected module before deciding how urgent it is.

The Past Eight Weeks

Any Score 7+ 8+ 9+

1 flaw, newest first.

11 Nov 2026 nginx-http-flv-module · Denial of service nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. CVE-2026-65982 8.7

nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14.

Patch this week · NVD Record

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions