CVE-2020-36309: Openresty Lua-Nginx-Module

Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days.

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

Affected products

• Openresty Lua-Nginx-Module: before 0.10.16 (fixed in 0.10.16)

Published 2021-04-06. Last modified 2026-06-17.