Nginx Open Source
Vendor:
First CVE: Feb 14, 2024 · Active for 2 years
25
Total CVEs
More Total CVEs than 95% of tracked products
8.3
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 26% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Nginx Open Source over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 14, 2024
2 years ago
Most Recent CVE
Jun 17, 2026
37 days ago
CVE Severity & Scoring
Nginx Open Source25 CVEs
48%
44%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local3 (12.0%)
Network22 (88.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (48.0%)
High13 (52.0%)
Unknown0 (0.0%)
User Interaction
None25 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low4 (16.0%)
High0 (0.0%)
None21 (84.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42945HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or s | May 13, 2026 | 8.1 | 79 | NO | NO |
CVE-2026-27654HIGH NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this | Mar 24, 2026 | 8.2 | 47 | NO | NO |
CVE-2026-42530HIGH NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along | Jun 17, 2026 | 8.1 | 44 | NO | NO |
CVE-2026-42055HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 o | Jun 17, 2026 | 8.1 | 43 | NO | NO |
CVE-2026-9256HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, | May 22, 2026 | 8.1 | 43 | NO | NO |
CVE-2026-32647HIGH NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX work | Mar 24, 2026 | 7.8 | 33 | NO | NO |
CVE-2026-27784HIGH The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory r | Mar 24, 2026 | 7.8 | 32 | NO | NO |
CVE-2026-42946HIGH A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi | May 13, 2026 | 7.4 | 31 | NO | NO |
CVE-2026-27651HIGH When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) | Mar 24, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-40460MEDIUM When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or | May 13, 2026 | 6.5 | 30 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (25 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (25 CVEs).
Media Mentions
Signals from CVEs in this product scope (25 CVEs).
Top CNAs Publishing CVEs For Nginx Open Source
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.31.1 | 1 | 8.1 | 3.5% | 0 | 0 |
| 1.31.0 | 1 | 8.1 | 4.3% | 0 | 0 |
| 1.27.0 | 1 | 4.7 | 0.3% | 0 | 0 |
| 1.25.3 | 1 | 7.5 | 1.1% | 0 | 0 |