NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The version of nginx installed on the remote host is prior to 1.30.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-015 advisory.

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a     string expression references the map's regex capture variables before referencing the map output variable.
    Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression     under certain conditions. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

    Impact:This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX     system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane     issue only.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42533)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This     vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off     directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle     (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the     NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX     worker process.

    Impact:This vulnerability may allow remote attackers to have limited control to modify memory contents or     restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-56434)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice     directive and unnamed regex captures are configured or when a background cache update happens,     unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker     process, leading to limited disclosure of memory or a restart.

    Impact:This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose     memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data     plane issue only.Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the
    --with-http_slice_module configuration parameter.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-60005)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2008 advisory.

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a     string expression references the map's regex capture variables before referencing the map output variable.
    Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression     under certain conditions. An unauthenticated attacker along with conditions beyond their control can     exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the     NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with     Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

    Impact:This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX     system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane     issue only.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42533)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This     vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off     directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle     (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the     NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX     worker process.

    Impact:This vulnerability may allow remote attackers to have limited control to modify memory contents or     restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-56434)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice     directive and unnamed regex captures are configured or when a background cache update happens,     unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker     process, leading to limited disclosure of memory or a restart.

    Impact:This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose     memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data     plane issue only.Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the
    --with-http_slice_module configuration parameter.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-60005)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 347fe124-8f53-11f1-9f4f-3c7c3fba4204 advisory.

    The Angie Software Team reports:
    When evaluating a string expression in which unnamed capture variables ($1, $2, etc.) preceded a map     directive variable whose value is determined by a regular expression, or when using a non-cacheable     (volatile) map directive variable whose key contained a capture variable also used in the value of the     same directive, worker process memory corruption or a worker process crash could occur (CVE-2026-42533);
    the fix was ported from nginx 1.31.3.
    When using the slice directive or background cache update, if unnamed capture variables ($1, $2, etc.)     were used together with a non-cacheable (volatile) map directive variable with a regular expression, the     value of an unnamed capture variable could contain arbitrary bytes from worker process memory, or a worker     process crash could occur (CVE-2026-60005); the fix was ported from nginx 1.31.3.
    When using the SSI module with unbuffered proxying, worker process memory corruption or a worker process     crash could occur (CVE-2026-56434); the fix was ported from nginx 1.31.3.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b93aae2d6 advisory.

    nginx-mod-vts:

    - Rebuild for 1.30.4

    nginx-mod-brotli:

    - Rebuild for 1.30.4

    nginx-mod-fancyindex:

    - Rebuild for 1.30.4

    nginx-mod-headers-more:

    - Rebuild for 1.30.4

    nginx-mod-modsecurity:

    - Rebuild for 1.30.4

    nginx-mod-naxsi:

    - Rebuild for 1.30.4

    nginx:

    - update to 1.30.4
    - fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is 1.30.0 prior to 1.30.4, or 1.31.2 prior to 1.31.3. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a     string expression references the map's regex capture variables before referencing the map output variable.
    Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression     under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit     this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX     worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space     Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may     allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code     execution. There is no control plane exposure; this is a data plane issue only. (CVE-2026-42533)

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability     may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured.
    With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control     responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This     issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This     vulnerability may allow remote attackers to have limited control to modify memory contents or restart the     NGINX worker process. There is no control plane exposure; this is a data plane issue only. (CVE-2026-56434)

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice     directive and unnamed regex captures are configured or when a background cache update happens,     unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker     process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote,     unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker     process. There is no control plane exposure; this is a data plane issue only. Note: The     ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module     configuration parameter. (CVE-2026-60005)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-60fc198d3b advisory.

    nginx-mod-fancyindex:

    - Rebuild for 1.30.4

    nginx-mod-modsecurity:

    - Rebuild for 1.30.4

    nginx-mod-naxsi:

    - Rebuild for 1.30.4

    nginx-mod-headers-more:

    - Rebuild for 1.30.4

    nginx-mod-brotli:

    - Rebuild for 1.30.4

    nginx-mod-js-challenge:

    - Rebuild for 1.30.4

    nginx-mod-vts:

    - Rebuild for 1.30.4

    nginx:

    - update to 1.30.4
    - fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a
    string expression references the map's regex capture variables before referencing the map output variable.
    Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression
    under certain conditions. An unauthenticated attacker along with conditions beyond their control can
    exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the
    NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with
    Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This
    vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to
    possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42533)

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This
    vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off
    directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle
    (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the
    NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX
    worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify
    memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data
    plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not
    evaluated. (CVE-2026-56434)

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice
    directive and unnamed regex captures are configured or when a background cache update happens,
    unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker
    process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow
    remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX
    worker process. There is no control plane exposure; this is a data plane issue only. Note: The
    ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module
    configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are
    not evaluated. (CVE-2026-60005)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-d1cd8e3d25 advisory.

    nginx-mod-fancyindex:

        Rebuild for 1.30.4

    nginx-mod-modsecurity:

        Rebuild for 1.30.4

    nginx-mod-naxsi:

        Rebuild for 1.30.4

    nginx-mod-headers-more:

        Rebuild for 1.30.4

    nginx-mod-brotli:

        Rebuild for 1.30.4

    nginx-mod-js-challenge:

        Rebuild for 1.30.4

    nginx-mod-vts:

        Rebuild for 1.30.4

    nginx:

        update to 1.30.4         fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 56feeac6-8263-11f1-92ba-bc24110523fe advisory.

    The nginx development team reports:
    Buffer overflow when using map and regex                 (CVE-2026-42533). Severity: major.
    Memory disclosure when using ngx_http_slice_module                 (CVE-2026-60005). Severity: medium.
    Use-after-free when using ngx_http_ssi_module                 (CVE-2026-56434). Severity: medium.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Nginx running on the remote host is prior to 1.30.4 or 1.31.x prior to 1.31.3. It is, therefore, affected by multiple vulnerabilities:

- A heap-based buffer overflow vulnerability exists in the map directive when regex matching is used and a string expression references the map's regex capture variables before referencing the map output variable, or when a non-cacheable variable is used in a string expression under certain conditions. An unauthenticated attacker can exploit this to cause a denial of service or potential code execution on systems with ASLR disabled. (CVE-2026-42533)

- An uninitialized memory access vulnerability exists in the ngx_http_slice_module module when the slice directive and unnamed regex captures are configured or when a background cache update occurs. An unauthenticated attacker can exploit this to cause limited disclosure of memory or a restart of the NGINX worker process. (CVE-2026-60005)

- A use-after-free vulnerability exists in the ngx_http_ssi_module module when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. An attacker with man-in-the-middle ability to control responses from an upstream server can exploit this to cause limited modification of memory or a restart of the NGINX worker process. (CVE-2026-56434)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice     directive and unnamed regex captures are configured or when a background cache update happens,     unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker     process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow     remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX     worker process. There is no control plane exposure; this is a data plane issue only. Note: The     ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module     configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are     not evaluated. (CVE-2026-60005)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
332006	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-015 (ALASNGINX1-2026-015)	Nessus	Amazon Linux Local Security Checks	critical
331990	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-2008)	Nessus	Amazon Linux Local Security Checks	critical
331833	FreeBSD : Angie -- multiple vulnerabilities (347fe124-8f53-11f1-9f4f-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	critical
330766	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-3b93aae2d6)	Nessus	Fedora Local Security Checks	critical
330084	nginx 1.30.x < 1.30.4 / 1.31.2 < 1.31.3 Multiple Vulnerabilities	Nessus	Web Servers	critical
329154	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-60fc198d3b)	Nessus	Fedora Local Security Checks	critical
444867	Alpine: nginx: security update to 1.30.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
444867	Alpine: nginx: security update to 1.30.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
444866	Alpine: nginx: security update to 1.28.3-r6	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
444866	Alpine: nginx: security update to 1.28.3-r6	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
328445	Fedora 45 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-d1cd8e3d25)	Nessus	Fedora Local Security Checks	critical
327771	FreeBSD : nginx -- multiple vulnerabilities (56feeac6-8263-11f1-92ba-bc24110523fe)	Nessus	FreeBSD Local Security Checks	critical
115314	Nginx < 1.30.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115313	Nginx 1.31.x < 1.31.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
327362	Linux Distros Unpatched Vulnerability : CVE-2026-60005	Nessus	Misc.	high

Detections

Analytics

CVE-2026-60005

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high