Detections
Analytics

Alpine: multiple nginx packages: security update to 1.30.6-r0

critical Tenable Self-Hosted Container Security Plugin ID 476639

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When
 asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI)
 page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process.
 This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on
 systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
 Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX
 system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this
 is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are
 not evaluated. (CVE-2026-97205)

 - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the
 alias directive together with rewrite and a set or return directive referencing the $request_filename
 variable. Alternatively, the same result could be achieved when the $request_filename variable is used in
 an access log format directive. An unauthenticated attacker along with conditions beyond their control can
 exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the
 NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with
 Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This
 vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to
 possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
 (CVE-2026-15176)

 - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3
 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could
 happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the
 attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart
 and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-
 of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this
 is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are
 not evaluated. (CVE-2026-90439)

 - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and
 the root directive or access log format references the map's regex capture variables before referencing
 the map output variable. Alternatively, the same result could be achieved by using a non-cacheable
 variable in a string expression under certain conditions. An unauthenticated attacker along with
 conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may
 cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can
 execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can
 bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on
 the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a
 data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not
 evaluated. (CVE-2026-93479)

 - Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When
 using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject
 data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the
 proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software
 versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-95101)

Solution

Update the nginx library and its related packages to version 1.30.6-r0 or later.

See Also

https://security.alpinelinux.org/vuln/CVE-2026-15176

https://security.alpinelinux.org/vuln/CVE-2026-90439

https://security.alpinelinux.org/vuln/CVE-2026-93479

https://security.alpinelinux.org/vuln/CVE-2026-95101

https://security.alpinelinux.org/vuln/CVE-2026-97205

https://security.alpinelinux.org/vuln/CVE-2026-97629

Plugin Details

Severity: Critical

ID: 476639

Version: Revision 1.1

Type: Local

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.34

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-97205

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-15176, CVE-2026-90439, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629

IAVA: 2026-A-0754