Critical Security Update for nginx: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:6906: Important: nginx security update. Affects nginx versions < 2:1.26.3-2.el10_1.1. Fixed in 2:1.26.3-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
nginx is a high-performance web and proxy server that supports HTTP and other protocols, designed for high concurrency, performance, and low memory usage. It is widely used for serving static content, load balancing, and as a reverse proxy. However, recent vulnerabilities have been identified that could compromise its security, necessitating immediate attention from users.
Vulnerability Detail
The vulnerabilities in nginx stem from issues related to specially crafted MP4 files and buffer overflows in the ngx_http_dav_module. These vulnerabilities can lead to Denial of Service (DoS) attacks, potential code execution, and memory corruption. Specifically, CVE-2026-32647 allows for DoS or code execution via crafted MP4 files, while CVE-2026-27654 and CVE-2026-27784 expose the server to DoS due to memory corruption and buffer overflow, respectively. Additionally, CVE-2026-27651 presents a risk of DoS through undisclosed requests when the ngx_mail_auth_http_module is enabled.
How To Fix
Minimum fixed version
2:1.26.3-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the ngx_mail_auth_http_module if it is not required for their operations. This can be done by commenting out or removing the relevant configuration lines in the nginx configuration file.
Conclusion
The identified vulnerabilities in nginx pose significant risks that can lead to service disruption and potential exploitation. It is crucial for users to update to the latest patched version to ensure the security and integrity of their web services. Monitoring tools like Vulert can assist in maintaining awareness of vulnerabilities in open-source software.
See every vulnerability recorded for nginx →
FAQ
nginx is a web server that also serves as a reverse proxy, load balancer, and HTTP cache, known for its high performance and low resource consumption.
The vulnerabilities can lead to Denial of Service attacks, potential code execution, and memory corruption, which can disrupt service and compromise server integrity.
You can check your nginx version using the command 'nginx -v' and compare it with the patched version 2:1.26.3-2.el10_1.1 to determine if you are vulnerable.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without signup.
If an immediate update is not possible, consider disabling vulnerable modules or implementing strict access controls to mitigate risks until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
