RHSA-2026:93472HighCVSS 8.2

Red Hat Security Advisory: nginx security update

Published
November 2, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (5)

CVE-2026-9256 →CVE-2026-42055 →CVE-2026-42533 →CVE-2026-56434 →CVE-2026-60005 →

📋 Description

CVE-2026-9256 — nginx: ngx_http_rewrite_module: code execution and denial of service CVE-2026-42055 — nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42533 — nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-56434 — nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-60005 — nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

🎯 Affected products64

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-1:1.20.1-14.el9_2.7.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-all-modules-1:1.20.1-14.el9_2.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debugsource-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-filesystem-1:1.20.1-14.el9_2.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • +34 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, use named captures instead of unnamed captures in rewrite definitions. For example, the following rewrite directive uses unnamed PCRE capture groups, $1 and $2: ~~~ rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last; ~~~ To mitigate this vulnerability for this example, replace $1 and $2 with the appropriate named captures, $user_id and $section: ~~~ rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last; ~~~ Workaround: To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service. Workaround: To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match. Red Hat recommends updating nginx to the latest version when a fix is available. Workaround: To prevent exploitation, avoid configuring NGINX with `ngx_http_ssi_module` when `proxy_pass` and `proxy_buffering off` are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the `ngx_http_ssi_module` by removing or commenting out the `ssi on;` directive. Alternatively, ensure `proxy_buffering` is explicitly enabled (`proxy_buffering on;`) when `proxy_pass` is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption. Workaround: To mitigate this issue, disable the ngx_http_slice_module entirely if it is not required. If the module must be used, avoid unnamed regex captures with the slice directive and explicitly disable proxy_cache_background_update. Reload or restart the NGINX service to apply these changes. Please note this may cause a brief service interruption.

🔗 References (8)