Impact statement: NGINX published May 2026 security updates for open source NGINX and NGINX Plus, including CVE-2026-42945. Public reporting rates CVE-2026-42945 as a critical memory-corruption risk that can lead to denial of service and, in specific configurations, possible remote code execution. If you run NGINX on public hosting, reverse proxies, CDN origins, Kubernetes ingress, API gateways, or customer web servers, patch now.
May 18, 2026 Update: Exploitation Attempts Reported
Update: Help Net Security reported on May 18, 2026 that VulnCheck saw exploitation attempts against CVE-2026-42945 beginning on May 16. CISA’s Known Exploited Vulnerabilities catalog was checked on May 18 and did not yet list this CVE, but public exploitation reporting is enough reason for hosting teams to move this from routine patching to urgent edge-server maintenance.
- Patch NGINX Open Source to 1.30.1 or 1.31.0, or apply the fixed NGINX Plus / vendor package for your supported release line.
- Prioritize public reverse proxies, CDN origins, customer hosting nodes, Kubernetes ingress workloads, and control-panel servers that front customer sites.
- After patching, validate configuration, reload or restart safely, and confirm customer sites still return clean 200 responses.
- Review NGINX error logs, service restarts, worker crashes, and unusual traffic spikes since May 16, especially on internet-facing systems that were still unpatched.
- For managed hosting, tell customers that NGINX security maintenance is being applied and that brief reloads may occur during verification.
This update stays defensive on purpose: it avoids offensive testing material and private edge rules. The practical move is to patch, verify, and review logs.
May 30, 2026 Update: NGINX 1.30.2 and 1.31.1 Now Matter
Update: NGINX’s official security advisory page now lists CVE-2026-9256, a medium-severity issue in the ngx_http_rewrite_module. The fixed open source NGINX branches are now 1.30.2 or newer and 1.31.1 or newer for this additional issue. If you patched only to 1.30.1 or 1.31.0 for the earlier May advisory cluster, schedule the next maintenance window and move to the newer fixed branch supplied by your package owner.
- Use the package source that owns NGINX on the server: OS vendor, official NGINX repository, control panel, reverse-proxy plugin, appliance vendor, or container image maintainer.
- Validate configuration before reload, drain customer-facing traffic where practical, and keep rollback access through snapshots, backups, or package-manager history.
- Prioritize public reverse proxies, CDN origins, hosting nodes, API gateways, Kubernetes ingress workloads, and control-panel systems that serve customer traffic.
- After the update, confirm the active NGINX binary and package version, reload status, TLS handshakes, HTTP/2 behavior, backend health checks, and representative customer sites.
This is still protect-only guidance: no offensive testing details are needed. The practical path is inventory, update to the fixed vendor package, validate, reload safely, and watch logs after the change.
There is a severity-language mismatch in the public sources: NGINX’s advisory page lists the issue as medium while NVD-style public reporting uses a critical CVSS score. Hosting operators should not get stuck on the label. The fix is available, the component is internet-facing in many environments, and NGINX sits directly in front of customer traffic.
Affected Versions
NGINX lists CVE-2026-42945 as affecting open source NGINX versions 0.6.27 through 1.30.0. The fixed open source releases for the earlier May cluster were NGINX 1.30.1 and NGINX 1.31.0; for CVE-2026-9256, move to NGINX 1.30.2 or NGINX 1.31.1 when your package source provides them. NGINX Plus administrators should apply the matching F5-published NGINX Plus patch for their supported release line.
The same May 2026 advisory page also lists related fixes for CVE-2026-42926, CVE-2026-42946, CVE-2026-42934, CVE-2026-40460, and CVE-2026-40701. Treat this as an NGINX security maintenance window, not a one-CVE-only task.
Who Should Prioritize This
- Public NGINX web servers and reverse proxies.
- Hosting providers using NGINX in front of Apache, PHP-FPM, Node.js, Python, or upstream app pools.
- CDN origins and customer edge gateways.
- cPanel, Plesk, DirectAdmin, Webmin/Virtualmin, and custom control-panel stacks that use NGINX.
- Kubernetes ingress, container images, and application delivery images that package NGINX.
- Load balancers and API gateways where NGINX config is generated by automation.
Check Your Version
# Show the active NGINX version.
nginx -v
# Show build options and module context.
nginx -V 2>&1 | tr ' ' 'n' | head -80
# Confirm the package source on Debian or Ubuntu.
apt-cache policy nginx
# Confirm the package source on AlmaLinux, Rocky, RHEL, or CloudLinux.
dnf info nginxIf your server reports NGINX 1.30.0 or older, check your vendor repository and update path. For NGINX Plus, follow the F5/NGINX Plus support advisory for your release line.
Patch On Ubuntu Or Debian
# Refresh repository metadata.
apt update
# Preview the available NGINX build.
apt-cache policy nginx
# Upgrade NGINX from the configured vendor repository.
apt install --only-upgrade nginx
# Validate config before reload.
nginx -t
# Reload if config validates.
systemctl reload nginxIf the distribution repository does not yet offer a fixed build, decide whether to use the official NGINX repository, a vendor backport, or a temporary maintenance plan. Do not mix random binaries into a production hosting server without documenting the package source and rollback path.
Patch On AlmaLinux, Rocky, RHEL, Or CloudLinux
# Check the current package and repository source.
dnf info nginx
# Apply the available security update.
dnf update nginx
# Validate and reload.
nginx -t
systemctl reload nginxOn cPanel, Plesk, DirectAdmin, and CloudLinux systems, confirm whether NGINX comes from the OS vendor, the control panel, a reverse-proxy plugin, or the official NGINX repository. Patch through the owner of that package source so future updates keep working.
Containers And Kubernetes
- Identify images that include NGINX, not just images named nginx.
- Rebuild custom images from a fixed base image.
- Update ingress controller images only after checking that project’s own advisory and release notes.
- Roll pods gradually and keep enough healthy replicas online.
- Confirm readiness, liveness, and traffic routing after the rollout.
# Example inventory checks.
kubectl get pods -A -o wide | grep -i nginx || true
kubectl get deployments -A | grep -i nginx || true
# After updating image references, roll one workload at a time.
kubectl rollout status deployment/YOUR-DEPLOYMENT -n YOUR-NAMESPACETemporary Mitigation If You Cannot Patch Today
The real fix is upgrading. If a production server cannot be patched immediately, review NGINX rewrite and regular-expression configuration, especially legacy rules that use unnamed captures. Move risky legacy patterns toward clearer named captures during a tested maintenance window, and validate the full config before reload. This is a stopgap, not a replacement for the fixed NGINX release.
Post-Patch Verification
# Confirm fixed version.
nginx -v
# Validate config.
nginx -t
# Confirm service status.
systemctl status nginx --no-pager
# Confirm a public site still responds.
curl -I https://example.com/Replace example.com with a domain on the server. For hosting nodes, test at least one static site, one PHP site, one proxied application, and one SSL/TLS vhost if those roles exist.
What To Review
- NGINX error logs around crashes, worker exits, and reload failures.
- Access logs for unusual request bursts against high-traffic vhosts.
- Package manager logs to confirm exactly when NGINX updated.
- Control-panel update logs if NGINX is managed by cPanel, Plesk, DirectAdmin, Webmin, Virtualmin, or a reverse-proxy plugin.
- Kubernetes event logs and rollout history for ingress or proxy workloads.
# Common log checks.
journalctl -u nginx --since "24 hours ago" --no-pager | tail -200
tail -n 200 /var/log/nginx/error.log
# Package history examples.
grep -i nginx /var/log/apt/history.log 2>/dev/null
dnf history info last 2>/dev/nullCustomer Communication
Tell customers the practical version: NGINX released a security update, edge and origin proxies are being patched, service reloads should be brief, and sites will be checked after the update. For managed hosting, mention that public websites should remain online unless a server also needs broader operating-system maintenance.
CDN And WAF Note
The CDN side should prioritize NGINX origin and reverse-proxy inventory. Virtual patching can help reduce suspicious traffic while servers are being updated, but do not depend on the edge alone. Patch the origin NGINX package, reload safely, and verify real customer traffic.
Sources
- NGINX security advisories
- NVD: CVE-2026-42945
- BleepingComputer coverage of CVE-2026-42945
- SecurityWeek coverage of NGINX memory-corruption flaw
- Help Net Security: attackers exploiting CVE-2026-42945
- VulnCheck Initial Access Intelligence, May 9-15, 2026
- CISA Known Exploited Vulnerabilities catalog
Need help patching NGINX on hosting servers, cPanel/Plesk nodes, CDN origins, or Kubernetes workloads? Open a ticket through Help4Network.com.
Related HTTP/2 edge defense guidance
For Nginx-backed hosting stacks, pair Nginx package review with the updated HAProxy CVE-2026-49975 HTTP/2 Bomb checklist if HAProxy, a CDN, or another edge proxy terminates HTTP/2.
