Vulnerabilities of F5 NGINX Open Source
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-95101 | Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module | 5.3 Medium | Oct 14, 2026 |
| CVE-2026-93479 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root… | 8.1 High | Oct 14, 2026 |
| CVE-2026-97205 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module | 8.1 High | Oct 14, 2026 |
| CVE-2026-15176 | A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive… | 8.1 High | Oct 14, 2026 |
| CVE-2026-97629 | Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an… | 6.5 Medium | Oct 14, 2026 |
| CVE-2026-90439 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module | 6.5 Medium | Sep 15, 2026 |
| CVE-2026-60005 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module | 8.2 High | Jul 15, 2026 |
| CVE-2026-56434 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module | 6.5 Medium | Jul 15, 2026 |
| CVE-2026-42533 | NGINX Map directive and Regex matching vulnerability | 8.1 High | Jul 15, 2026 |
| CVE-2026-42055 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules | 8.1 High | Jun 17, 2026 |
| CVE-2026-42530 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module | 8.1 High | Jun 17, 2026 |
| CVE-2026-48142 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module | 4.8 Medium | Jun 17, 2026 |
| CVE-2026-9256 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module | 8.1 High | May 22, 2026 |
| CVE-2026-40460 | When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof… | 6.5 Medium | May 13, 2026 |
| CVE-2026-42926 | When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses… | 5.8 Medium | May 13, 2026 |
| CVE-2026-42934 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module | 4.8 Medium | May 13, 2026 |
| CVE-2026-42946 | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory… | 6.5 Medium | May 13, 2026 |
| CVE-2026-40701 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the… | 4.8 Medium | May 13, 2026 |
| CVE-2026-42945 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module | 8.1 High | May 13, 2026 |
| CVE-2026-27651 | When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can… | 7.5 High | Mar 24, 2026 |
| CVE-2026-28755 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling… | 5.4 Medium | Mar 24, 2026 |
| CVE-2026-28753 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of… | 3.7 Low | Mar 24, 2026 |
| CVE-2026-27654 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker… | 8.2 High | Mar 24, 2026 |
| CVE-2026-27784 | The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might… | 7.8 High | Mar 24, 2026 |
| CVE-2026-32647 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker… | 7.8 High | Mar 24, 2026 |
Other F5 products
BIG-IP 259
NGINX Plus 37
BIG-IP Next CNF 26
BIG-IP Next SPK 23
BIG-IQ 20
BIG-IP Next for Kubernetes 13
F5OS - Appliance 12
BIG-IP APM 12
BIG-IP Edge Client 11
F5OS - Chassis 10
BIG-IP Next Central Manager 9
BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 8