nginx vulnerabilities in 2026: which version you need and how to protect it

nginx runs a huge share of the world's websites, reverse proxies and load balancers. In 2026 the nginx project has published 26 security advisories — far more than usual. Most are rated “medium” by nginx because they need a specific configuration, but several can lead to memory corruption and possibly code execution. F5, which develops nginx, rated some of the October issues as critical (CVSS 4.0: 9.2).

The most important ones

Other 2026 advisories affect the HTTP/2 and gRPC proxy, mp4, slice, SSI, DAV, charset modules, the mail proxy and OCSP. The full list is on nginx.org.

What to do

1. Update to nginx 1.31.7 or later (mainline) or 1.30.6 or later (stable). These versions close every advisory published so far in 2026.
2. If you use nginx from your Linux distribution, install the vendor's security update — the version number may stay the same with fixes backported. Check the vendor advisory.
3. Remember nginx inside other products: Kubernetes ingress controllers, Docker images, control panels and appliances also need updates. Rebuild container images.
4. Until you can update, turn off features you do not use: HTTP/3 (QUIC), aio, SSI, WebDAV, mp4 streaming, the mail proxy.
5. Review complex rewrite, alias and map rules with regular expressions — several bugs are triggered by them.
6. Protect admin areas and APIs with access lists, and put a WAF in front of important applications.

A web server is the front door of your company on the internet. Keep its lock up to date.

CySec audits and updates web servers and reverse proxies, sets up secure nginx configurations and monitors new advisories for you.

Source: nginx security advisories.

All articles