PatchTheCVEnginx vulnerabilities
Recent CVEs affecting nginx products. 5 tracked.
nginx has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2022-08-18. Highest priority: CVE-2021-46461 (score 71/100).
- CVE-2022-35173 HIGH 7.5 DOWNGRADE An issue was discovered in Nginx NJS v0.7.5
- CVE-2022-30503 MEDIUM 5.5 DOWNGRADE Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_
- CVE-2022-29780 MEDIUM 5.5 DOWNGRADE Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort a
- CVE-2022-29779 MEDIUM 5.5 DOWNGRADE Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at
- CVE-2021-46461 CRITICAL 9.8 UPGRADE njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeo
FAQ
How do I fix nginx vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nginx being exploited right now?
None of the tracked nginx CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nginx CVE should I patch first?
CVE-2021-46461 currently ranks highest (71/100): njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeo.