F5 NGINX Open Source
35 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-95101 | 1.31.0 – < 1.31.7 ; 1.30.0 – < 1.30.6 ; ≥ 1.25.0 | NGINX ngx_http_v3_module vulnerability | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-97205 | 1.31.0 – < 1.31.7 ; 1.30.0 – < 1.30.6 | NGINX ngx_http_core_module vulnerability | CRITICAL 9.2 | 0.8 % | ||
| CVE-2026-93479 | 1.31.2 – < 1.31.7 ; 1.30.0 – < 1.30.6 | NGINX map directive and regex matching vulnerability | CRITICAL 9.2 | 1.2 % | ||
| CVE-2026-97629 | 1.31.0 – < 1.31.7 ; 1.30.0 – < 1.30.6 ; ≥ 1.23.3 | NGINX ngx_http_ssl_module vulnerability | HIGH 8.3 | 0.2 % | ||
| CVE-2026-15176 | 1.31.0 – < 1.31.7 ; 0.1.29 – < 1.30.6 | NGINX ngx_http_core_module vulnerability | CRITICAL 9.2 | 0.8 % | ||
| CVE-2026-90439 | 1.29.2 – < 1.31.6 ; 1.30.4 – < 1.30.5 | NGINX ngx_http_v3_module vulnerability | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-60005 | 1.31.2 – < 1.31.3 ; 1.15.8 – < 1.30.4 | NGINX ngx_http_slice_module vulnerability | HIGH 8.8 | 0.5 % | ||
| CVE-2026-56434 | 1.31.2 – < 1.31.3 ; 0.8.11 – < 1.30.4 | NGINX ngx_http_ssi_module vulnerability | HIGH 8.3 | 0.4 % | ||
| CVE-2026-42533 | 1.31.2 – < 1.31.3 ; 0.9.6 – < 1.30.4 | NGINX Map directive and Regex matching vulnerability | CRITICAL 9.2 | 0.9 % | ||
| CVE-2026-48142 | 1.13.10 – < 1.31.2 ; 1.30.0 – < 1.30.3 | NGINX ngx_http_charset_module vulnerability | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-42530 | 1.31.0 – < 1.31.2 | NGINX Open-Source ngx_http_v3_module vulnerability | CRITICAL 9.2 | 6.5 % | ||
| CVE-2026-42055 | 1.13.10 – < 1.31.2 ; 1.30.2 – < 1.30.3 | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | CRITICAL 9.2 | 6.5 % | ||
| CVE-2026-9256 | 1.31.0 – < 1.31.1 ; 1.30.0 – < 1.30.2 ; 0.1.17 – 0.9.7 | NGINX ngx_http_rewrite_module vulnerability | CRITICAL 9.2 | 11 % | ||
| CVE-2026-42926 | 1.29.4 – < 1.30.1 | NGINX ngx_http_proxy_v2_module vulnerability | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-40460 | 1.26.0 – < 1.30.1 | NGINX ngx_quic_module vulnerability | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-42946 | 0.8.42 – < 1.30.1 | NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability | HIGH 8.3 | 0.9 % | ||
| CVE-2026-42934 | 0.3.50 – < 1.30.1 | NGINX ngx_http_charset_module vulnerability | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-42945 | 0.6.27 – < 1.30.1 | NGINX ngx_http_rewrite_module vulnerability | CRITICAL 9.2 | 68 % | ||
| CVE-2026-40701 | 1.19.0 – < 1.30.1 | NGINX ngx_http_ssl_module vulnerability | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-27651 | 1.29.0 – < 1.29.7 ; 0.5.15 – < 1.28.3 | NGINX ngx_mail_auth_http_module vulnerability | HIGH 8.7 | 1.0 % | ||
| CVE-2026-28755 | 1.29.0 – < 1.29.7 ; 1.27.2 – < 1.28.3 | NGINX ngx_stream_ssl_module vulnerability | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-28753 | 1.29.0 – < 1.29.7 ; 0.6.27 – < 1.28.3 | NGINX ngx_mail_proxy_module vulnerability | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-27654 | 1.29.0 – < 1.29.7 ; 0.5.13 – < 1.28.3 | NGINX ngx_http_dav_module vulnerability | HIGH 8.8 | 26 % | ||
| CVE-2026-32647 | 1.29.0 – < 1.29.7 ; 1.1.19 – < 1.28.3 | NGINX ngx_http_mp4_module vulnerability | HIGH 8.5 | 0.9 % | ||
| CVE-2026-27784 | 1.29.0 – < 1.29.7 ; 1.1.19 – < 1.28.3 | NGINX ngx_http_mp4_module vulnerability | HIGH 8.5 | 1.1 % | ||
| CVE-2026-1642 | 1.3.0 – < 1.29.5 | NGINX vulnerability | HIGH 8.2 | 0.4 % | ||
| CVE-2025-53859 | 0.7 – < 1.29.1 | NGINX ngx_mail_smtp_module vulnerability | MEDIUM 6.3 | 0.4 % | ||
| CVE-2025-23419 | ≥ 1.11.4 | TLS Session Resumption Vulnerability | MEDIUM 5.3 | 2.8 % | ||
| CVE-2024-7347 | ≥ 1.5.13 | NGINX MP4 module vulnerability | MEDIUM 5.7 | 0.3 % | ||
| CVE-2024-35200 | 1.25.0 – < 1.26.1 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 5.3 | 0.9 % | ||
| CVE-2024-34161 | 1.25.0 – < 1.26.1 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 5.3 | 0.9 % | ||
| CVE-2024-32760 | 1.25.0 – < 1.26.1 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 6.5 | 0.9 % | ||
| CVE-2024-31079 | 1.25.0 – < 1.26.1 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 4.8 | 0.9 % | ||
| CVE-2024-24990 | 1.25.0 – < 1.25.4 | NGINX HTTP/3 QUIC vulnerability | HIGH 7.5 | 0.9 % | ||
| CVE-2024-24989 | 1.25.3 – < 1.25.4 | NGINX HTTP/3 QUIC vulnerability | HIGH 7.5 | 1.1 % |