The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb53cb4d67 advisory.

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2050-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is     enabled       (bsc#1260415).
    - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file     (bsc#1260420).
    - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the     `ssl_ocsp` directives       are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
    - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module`     module       (bsc#1265231).
    - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`       (bsc#1265232).
    - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module`     and       `ngx_http_uwsgi_module` modules (bsc#1265233).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8375-1 advisory.

    It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain memory operations     when doing SMTP authentication. This could possibly result in sensitive information being sent to the     authentication server. (CVE-2025-53859)

    It was discovered that nginx incorrectly handled proxying to upstream TLS servers. An attacker could     possibly use this issue to insert plain text data into the response from an upstream proxied server.
    (CVE-2026-1642)

    It was discovered that the nginx ngx_mail_auth_http_module module incorrectly handled certain requests. An     attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service.
    (CVE-2026-27651)

    It was discovered that the nginx ngx_http_dav_module module incorrectly handled certain destination URIs.
    An attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     modify source or destination names outside of the document root. (CVE-2026-27654)

    It was discovered that the nginx ngx_http_mp4_module module incorrectly handled certain MP4 files. An     attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2026-27784, CVE-2026-32647)

    It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain CRLF sequences.
    An attacker could possibly use this issue to inject arbitrary SMTP headers. (CVE-2026-28753)

    It was discovered that nginx contained a use-after-free vulnerability in the ngx_http_ssl_module module     when client certificate verification and OCSP validation were enabled. A remote attacker could use this     issue to cause nginx to crash, resulting in a denial of service, or possibly modify data in memory.
    (CVE-2026-40701)

    It was discovered that nginx did not properly handle certain proxied responses in the     ngx_http_charset_module module. A remote attacker could possibly use this issue to obtain sensitive     information or cause nginx to crash, resulting in a denial of service. (CVE-2026-42934)

    It was discovered that the nginx ngx_http_rewrite_module component incorrectly handled certain rewrite     directives. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2026-42945)

    It was discovered that nginx did not properly process certain SCGI and uWSGI responses. An attacker able     to perform a machine-in-the-middle attack could possibly use this issue to obtain sensitive information or     cause nginx to crash, resulting in a denial of service. (CVE-2026-42946)

    It was discovered that nginx incorrectly handled certain rewrite rules in the ngx_http_rewrite_module     module. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-9256)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
314984	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-fb53cb4d67)	Nessus	Fedora Local Security Checks	2026/5/15	2026/6/18	critical
316725	SUSE SLES15 Security Update : nginx (SUSE-SU-2026:2050-1)	Nessus	SuSE Local Security Checks	2026/5/26	2026/6/18	critical
318631	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : nginx vulnerabilities (USN-8375-1)	Nessus	Ubuntu Local Security Checks	2026/6/4	2026/6/17	critical

检测

插件搜索

critical

critical

critical