Nginx < 1.30.1 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 115243

Language:

Synopsis

Description

According to its Server response header, the installed version of nginx is prior to 1.30.1. It is, therefore, affected by the following issues :

- A heap-use-after-free vulnerability in the ngx_http_ssl_module module when ssl_verify_client is set to 'on' or 'optional' and ssl_ocsp is enabled with a resolver, which may allow an unauthenticated remote attacker to cause worker process restarts or limited memory modification. (CVE-2026-40701)

- A vulnerability in the ngx_quic_module module when HTTP/3 is enabled that allows an attacker to spoof their source IP address, potentially bypassing IP-based authorization or rate limiting. (CVE-2026-40460)

- A heap buffer over-read vulnerability in the ngx_http_charset_module module when charset, source_charset, charset_map, and proxy_pass with response buffering disabled are all configured, which may allow an unauthenticated remote attacker to cause limited memory disclosure or a worker process restart. (CVE-2026-42934)

- A vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may allow an attacker with man-in-the-middle access to upstream SCGI or uWSGI responses to trigger excessive memory allocation or a data over-read, potentially disclosing worker memory or causing a restart. (CVE-2026-42946)

- A heap buffer overflow vulnerability in the ngx_http_rewrite_module module when a rewrite directive is followed by rewrite, if, or set with unnamed PCRE captures and a replacement string containing '?', which may allow an unauthenticated remote attacker to cause worker process restarts or, on systems without ASLR, potentially execute code. (CVE-2026-42945)

- A vulnerability in the ngx_http_proxy_v2_module module when proxy_http_version 2 and proxy_set_body are used together that allows an attacker to inject HTTP/2 frame headers and payload bytes toward the upstream peer. (CVE-2026-42926)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.