PatchTheCVEnginx open source vulnerabilities and fixes
Recent CVEs affecting nginx open source, with upgrade or downgrade steps. 5 tracked.
Also searched as: nginxopensource.
nginx open source has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-06-17. Highest priority: CVE-2026-42945 (score 68/100).
- CVE-2026-42945 HIGH 8.1 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
- CVE-2026-42946 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excess
- CVE-2026-42934 MEDIUM 4.8 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module
- CVE-2026-42926 MEDIUM 5.8 UPGRADE UPGRADE When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses
- CVE-2026-42530 HIGH 8.1 UPGRADE UPGRADE NGINX Open Source has a vulnerability in the ngx_http_v3_module module
FAQ
How do I fix nginx open source vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nginx open source being exploited right now?
None of the tracked nginx open source CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nginx open source CVE should I patch first?
CVE-2026-42945 currently ranks highest (68/100): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.