Critical Security Update for nginx: Heap Buffer Over-read and Memory Disclosure Vulnerabilities
Summary
ALSA-2026:59362: Important: nginx security update. Affects nginx versions < 2:1.20.1-28.el9_8.5.alma.1. Fixed in 2:1.20.1-28.el9_8.5.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a high-performance web and proxy server that supports HTTP and other protocols, designed for high concurrency, low memory usage, and optimal performance. It is widely used for serving static content, load balancing, and as a reverse proxy. However, recent vulnerabilities have been identified that could compromise its security, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities in nginx stem from a heap buffer over-read that allows for memory modification or denial of service (CVE-2026-56434) and memory disclosure issues in the ngx_http_slice_module (CVE-2026-60005). These vulnerabilities could lead to unauthorized access to sensitive information or service disruptions, posing a significant risk to applications relying on nginx for web services.
How To Fix
Minimum fixed version
2:1.20.1-28.el9_8.5.alma.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected modules or disable them until the update is applied. This can be done by modifying the nginx configuration files to comment out or remove the directives related to the ngx_http_slice_module.
Conclusion
The identified vulnerabilities in nginx present serious risks that could compromise web services. It is crucial for users to update their installations to the latest patched version to mitigate these risks. Implementing the recommended fixes and workarounds will help maintain the security and integrity of your applications.
See every vulnerability recorded for nginx →
FAQ
The vulnerabilities involve a heap buffer over-read and memory disclosure, which could lead to memory modification or denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider limiting access to the affected modules or disabling them in your configuration as a temporary workaround.
The vulnerabilities could lead to unauthorized access to sensitive data or service interruptions, affecting the availability and integrity of your web services.
For detailed information about the security issues, refer to the CVE pages linked in the advisory or the official nginx documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
