CVE catalog
CVE-2026-42934
NGINX Plus and NGINX Open Source have a vulnerability…
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Severity
- Medium · CVSS 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.73% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "nginx",
"status": "fixed",
"release": "sid",
"version": "1.30.6-2"
},
{
"name": "nginx",
"status": "fixed",
"release": "forky",
"version": "1.30.6-2"
},
{
"name": "nginx",
"status": "fixed",
"release": "trixie",
"version": "1.26.3-3+deb13u7"
},
{
"name": "nginx",
"status": "fixed",
"release": "trixie-security",
"version": "1.26.3-3+deb13u10"
},
{
"name": "nginx",
"status": "fixed",
"release": "bookworm",
"version": "1.22.1-9+deb12u9"
},
{
"name": "nginx",
"status": "fixed",
"release": "bookworm-security",
"version": "1.22.1-9+deb12u10"
}
],
"fixed_versions": [
{
"bug": null,
"name": "nginx",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "1.30.0-4"
},
{
"bug": null,
"name": "nginx",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "1.30.0-4"
},
{
"bug": null,
"name": "nginx",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "1.26.3-3+deb13u5"
},
{
"bug": null,
"name": "nginx",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "1.22.1-9+deb12u7"
}
],
"distribution_packages": [
{
"name": "nginx",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-http-geoip",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-http-image-filter",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-http-perl",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-http-xslt-filter",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-mail",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-stream",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "libnginx-mod-stream-geoip",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-common",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-core",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-dev",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-doc",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-extras",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-full",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "nginx-light",
"ecosystem": "cpe",
"fixed_version": "1.24.0-2ubuntu7.9"
},
{
"name": "dos",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "nginx_gateway_fabric",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "nginx_ingress_controller",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "nginx_instance_manager",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "nginx_open_source",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "nginx_plus",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "waf",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "nginx",
"ecosystem": "cpe",
"fixed_version": "1.22.1-9+deb12u7"
},
{
"name": "nginx",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.3-r1"
}
]
}
],
"release": "3.21",
"versions": [],
"ecosystem": "apk",
"fixed_version": "1.26.3-r1",
"provider_record_id": "ALPINE-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.3-r1"
}
]
}
],
"release": "3.22",
"versions": [],
"ecosystem": "apk",
"fixed_version": "1.28.3-r1",
"provider_record_id": "ALPINE-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.3-r1"
}
]
}
],
"release": "3.23",
"versions": [],
"ecosystem": "apk",
"fixed_version": "1.28.3-r1",
"provider_record_id": "ALPINE-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "alpine",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.30.1-r0"
}
]
}
],
"release": "3.24",
"versions": [],
"ecosystem": "apk",
"fixed_version": "1.30.1-r0",
"provider_record_id": "ALPINE-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0-0ubuntu1.7+esm1"
}
]
}
],
"release": "pro",
"versions": [
"1.16.1-0ubuntu2",
"1.16.1-0ubuntu3",
"1.17.5-0ubuntu1",
"1.17.6-0ubuntu1",
"1.17.7-0ubuntu1",
"1.17.8-0ubuntu1",
"1.17.8-0ubuntu2",
"1.17.8-0ubuntu3",
"1.17.9-0ubuntu1",
"1.17.9-0ubuntu2",
"1.17.9-0ubuntu3",
"1.17.10-0ubuntu1",
"1.18.0-0ubuntu1",
"1.18.0-0ubuntu1.2",
"1.18.0-0ubuntu1.3",
"1.18.0-0ubuntu1.4",
"1.18.0-0ubuntu1.5",
"1.18.0-0ubuntu1.6",
"1.18.0-0ubuntu1.7"
],
"ecosystem": "deb",
"fixed_version": "1.18.0-0ubuntu1.7+esm1",
"provider_record_id": "UBUNTU-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0-6ubuntu14.12"
}
]
}
],
"release": "22.04",
"versions": [
"1.18.0-6ubuntu11",
"1.18.0-6ubuntu12",
"1.18.0-6ubuntu14",
"1.18.0-6ubuntu14.1",
"1.18.0-6ubuntu14.2",
"1.18.0-6ubuntu14.3",
"1.18.0-6ubuntu14.4",
"1.18.0-6ubuntu14.5",
"1.18.0-6ubuntu14.6",
"1.18.0-6ubuntu14.7",
"1.18.0-6ubuntu14.8",
"1.18.0-6ubuntu14.10",
"1.18.0-6ubuntu14.11"
],
"ecosystem": "deb",
"fixed_version": "1.18.0-6ubuntu14.12",
"provider_record_id": "UBUNTU-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.0-2ubuntu7.9"
}
]
}
],
"release": "24.04",
"versions": [
"1.24.0-1ubuntu1",
"1.24.0-2ubuntu1",
"1.24.0-2ubuntu2",
"1.24.0-2ubuntu3",
"1.24.0-2ubuntu4",
"1.24.0-2ubuntu6",
"1.24.0-2ubuntu7",
"1.24.0-2ubuntu7.1",
"1.24.0-2ubuntu7.3",
"1.24.0-2ubuntu7.4",
"1.24.0-2ubuntu7.5",
"1.24.0-2ubuntu7.6",
"1.24.0-2ubuntu7.7",
"1.24.0-2ubuntu7.8"
],
"ecosystem": "deb",
"fixed_version": "1.24.0-2ubuntu7.9",
"provider_record_id": "UBUNTU-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.0-6ubuntu1.4"
}
]
}
],
"release": "25.10",
"versions": [
"1.26.3-2ubuntu1",
"1.26.3-3ubuntu1",
"1.26.3-3ubuntu2",
"1.26.3-3ubuntu3",
"1.28.0-3ubuntu1",
"1.28.0-4ubuntu1",
"1.28.0-6ubuntu1",
"1.28.0-6ubuntu1.1",
"1.28.0-6ubuntu1.2",
"1.28.0-6ubuntu1.3"
],
"ecosystem": "deb",
"fixed_version": "1.28.0-6ubuntu1.4",
"provider_record_id": "UBUNTU-CVE-2026-42934"
},
{
"name": "nginx",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.3-2ubuntu1.2"
}
]
}
],
"release": "26.04",
"versions": [
"1.28.0-6ubuntu1",
"1.28.1-2ubuntu1",
"1.28.1-3ubuntu1",
"1.28.2-2ubuntu1",
"1.28.3-2ubuntu1",
"1.28.3-2ubuntu1.1"
],
"ecosystem": "deb",
"fixed_version": "1.28.3-2ubuntu1.2",
"provider_record_id": "UBUNTU-CVE-2026-42934"
},
{
"name": "dos",
"ranges": [],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
},
{
"name": "nginx_gateway_fabric",
"ranges": [
{
"fixed": "",
"introduced": "2.0.0",
"last_affected": "2.6.0",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
},
{
"name": "nginx_ingress_controller",
"ranges": [
{
"fixed": "",
"introduced": "5.0.0",
"last_affected": "5.4.2",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
},
{
"name": "nginx_instance_manager",
"ranges": [
{
"fixed": "",
"introduced": "2.16.0",
"last_affected": "2.22.0",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
},
{
"name": "nginx_open_source",
"ranges": [
{
"fixed": "",
"introduced": "1.0.0",
"last_affected": "1.30.0",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
},
{
"name": "nginx_plus",
"ranges": [
{
"fixed": "",
"introduced": "r32",
"last_affected": "r36",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
},
{
"name": "waf",
"ranges": [
{
"fixed": "",
"introduced": "5.9.0",
"last_affected": "5.12.1",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "",
"provider_record_id": "NVD-CVE-2026-42934"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libnginx-mod-http-geoip]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [libnginx-mod-http-image-filter]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [libnginx-mod-http-perl]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [libnginx-mod-http-xslt-filter]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [libnginx-mod-mail]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [libnginx-mod-stream]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [libnginx-mod-stream-geoip]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx]Unknown
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-common]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-core]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-dev]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-doc]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-extras]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· amd64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-full]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
- [nginx-light]Unknown
Source package: [nginx]
Details (4)
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookwormFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
1.22.1-9+deb12u9· all · bookworm-securityFixed · Fixed:
1.22.1-9+deb12u7nvd · nginx · debian · bookworm; nvd · nginx · debian · 12
[Debian 13 (Trixie)]
- [libnginx-mod-http-geoip]Unknown
Source package: [nginx]
Details (7)
1.26.3-3+deb13u7· amd64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u10· amd64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u8· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u9· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
- [libnginx-mod-http-image-filter]Unknown
Source package: [nginx]
Details (7)
1.26.3-3+deb13u7· amd64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u10· amd64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u8· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u9· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
- [libnginx-mod-http-perl]Unknown
Source package: [nginx]
Details (7)
1.26.3-3+deb13u7· amd64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u10· amd64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u8· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u9· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
- [libnginx-mod-http-xslt-filter]Unknown
Source package: [nginx]
Details (7)
1.26.3-3+deb13u7· amd64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u10· amd64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u8· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u9· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
- [libnginx-mod-mail]Unknown
Source package: [nginx]
Details (7)
1.26.3-3+deb13u7· amd64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixieFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u10· amd64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u7· arm64 · trixie-securityFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u8· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
1.26.3-3+deb13u9· amd64 · trixie-security · Historical versionFixed · Fixed:
1.26.3-3+deb13u5nvd · nginx · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10796-1.json]
- [https://my.f5.com/manage/s/article/K000161028]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-42934]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-42934]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-42934]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-42934]
- [https://security-tracker.debian.org/tracker/CVE-2026-42934]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42934.json]
- [https://ubuntu.com/security/notices/USN-8354-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1527.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]