When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8354-1 advisory.

    It was discovered that nginx did not properly validate source addresses in the HTTP/3 QUIC module. A     remote attacker could possibly use this issue to bypass authorization checks or rate limiting. This issue     only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-40460)

    It was discovered that nginx contained a use-after-free vulnerability in the ngx_http_ssl_module module     when client certificate verification and OCSP validation were enabled. A remote attacker could use this     issue to cause nginx to crash, resulting in a denial of service, or possibly modify data in memory.
    (CVE-2026-40701)

    It was discovered that nginx did not properly handle certain proxied responses in the     ngx_http_charset_module module. A remote attacker could possibly use this issue to obtain sensitive     information or cause nginx to crash, resulting in a denial of service. (CVE-2026-42934)

    It was discovered that nginx did not properly process certain SCGI and uWSGI responses. An attacker able     to perform a machine-in-the-middle attack could possibly use this issue to obtain sensitive information or     cause nginx to crash, resulting in a denial of service. (CVE-2026-42946)

    It was discovered that nginx incorrectly handled certain rewrite rules in the ngx_http_rewrite_module     module. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-9256)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote host is prior to 1.30.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-012 advisory.

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able     to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note:
    Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-40460)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the     ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the     leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can     send requests along with conditions beyond its control that may cause a heap-use-after-free error in the     NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker     process restarting.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-40701)

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also     uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream     peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42926)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset,     source_charset, and charset_map and proxy_pass with disabled buffering (off) directives are configured,     unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a     heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42934)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This     vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an     unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string     that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control     can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in     the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout     Randomization (ASLR ) disabled, code execution is possible.  Note: Software versions which have reached     End of Technical Support (EoTS) are not evaluated. (CVE-2026-42945)

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in     excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an     unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream     server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions     which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-42946)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1714 advisory.

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able     to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note:
    Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-40460)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the     ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the     leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can     send requests along with conditions beyond its control that may cause a heap-use-after-free error in the     NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker     process restarting.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-40701)

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also     uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream     peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42926)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset,     source_charset, and charset_map and proxy_pass with disabled buffering (off) directives are configured,     unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a     heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42934)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This     vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an     unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string     that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control     can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in     the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout     Randomization (ASLR ) disabled, code execution is possible.  Note: Software versions which have reached     End of Technical Support (EoTS) are not evaluated. (CVE-2026-42945)

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in     excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an     unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream     server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions     which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-42946)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1ed77d8e-53bb-11f1-b339-3497f65b111b advisory.

    The nginx project reports:
    nginx 1.31.0 fixes multiple security issues affecting HTTP/2                 proxying, rewrite handling, SCGI/uWSGI response handling, charset                 conversion, HTTP/3 connection migration, and OCSP resolver response                 processing.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is prior to 1.30.1. It is, therefore, affected by the following issues :

 - A heap-use-after-free vulnerability in the ngx_http_ssl_module module when ssl_verify_client is set to 'on' or 'optional' and ssl_ocsp is enabled with a resolver, which may allow an unauthenticated remote attacker to cause worker process restarts or limited memory modification. (CVE-2026-40701)

 - A vulnerability in the ngx_quic_module module when HTTP/3 is enabled that allows an attacker to spoof their source IP address, potentially bypassing IP-based authorization or rate limiting. (CVE-2026-40460)

 - A heap buffer over-read vulnerability in the ngx_http_charset_module module when charset, source_charset, charset_map, and proxy_pass with response buffering disabled are all configured, which may allow an unauthenticated remote attacker to cause limited memory disclosure or a worker process restart. (CVE-2026-42934)

 - A vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may allow an attacker with man-in-the-middle access to upstream SCGI or uWSGI responses to trigger excessive memory allocation or a data over-read, potentially disclosing worker memory or causing a restart. (CVE-2026-42946)

 - A heap buffer overflow vulnerability in the ngx_http_rewrite_module module when a rewrite directive is followed by rewrite, if, or set with unnamed PCRE captures and a replacement string containing '?', which may allow an unauthenticated remote attacker to cause worker process restarts or, on systems without ASLR, potentially execute code. (CVE-2026-42945)

 - A vulnerability in the ngx_http_proxy_v2_module module when proxy_http_version 2 and proxy_set_body are used together that allows an attacker to inject HTTP/2 frame headers and payload bytes toward the upstream peer. (CVE-2026-42926)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6278 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6278-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 16, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nginx     CVE ID         : CVE-2026-40701 CVE-2026-42934 CVE-2026-42945                      CVE-2026-42946 CVE-2026-40460

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web     and reverse proxy server, which could result in bypass of authorisation     rules or rate limits, denial of service or memory disclosure.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1.22.1-9+deb12u7.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.3-3+deb13u5.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-38623b4fed advisory.

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-094eb13bb1 advisory.

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx-mod-js-challenge:

    - Rebuild for 1.30.1

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb53cb4d67 advisory.

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3414ac89-4f9f-11f1-a1c0-0050569f0b83 advisory.

    nginx development team reports:
    When using the proxy_set_body directive, an attacker               might inject data in the proxied request to an HTTP/2 backend     A heap memory buffer overflow might occur in a worker               process while handling a specially crafted request by               ngx_http_rewrite_module, potentially resulting in arbitrary code               execution     A heap memory buffer overread might occur in a worker               process while handling a specially crafted response by               ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker               to cause a disclosure of worker process memory or segmentation fault               in a worker process     A heap memory buffer overread might occur in a worker               process while handling a specially sent response with decoding from               UTF-8 via the charset_map directive, allowing an attacker to cause               a limited disclosure of worker proccess memory or segmentation fault               in a worker process     When using HTTP/3, processing of connection migration might               cause new QUIC streams to receive a new client address before               validation, allowing an attacker to cause address spoofing     use-after-free might occur during DNS server response               processing if the ssl_ocsp directive was used, allowing an attacker               to cause worker process memory corruption or segmentation fault in a               worker process

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able     to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note:
    Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-40460)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318250	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : nginx vulnerabilities (USN-8354-1)	Nessus	Ubuntu Local Security Checks	critical
316959	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-012 (ALASNGINX1-2026-012)	Nessus	Amazon Linux Local Security Checks	critical
316933	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1714)	Nessus	Amazon Linux Local Security Checks	critical
315600	FreeBSD : nginx-devel -- multiple vulnerabilities (1ed77d8e-53bb-11f1-b339-3497f65b111b)	Nessus	FreeBSD Local Security Checks	critical
115243	Nginx < 1.30.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
315084	Debian dsa-6278 : libnginx-mod-http-geoip - security update	Nessus	Debian Local Security Checks	critical
314992	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-38623b4fed)	Nessus	Fedora Local Security Checks	critical
314989	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)	Nessus	Fedora Local Security Checks	critical
314984	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-fb53cb4d67)	Nessus	Fedora Local Security Checks	critical
314915	FreeBSD : www/nginx -- Remote Code Execution/DoS (3414ac89-4f9f-11f1-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	critical
314521	Linux Distros Unpatched Vulnerability : CVE-2026-40460	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-40460

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium