F5 Nginx Plus vulnerabilities

36 CVEs affecting F5 Nginx Plus, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97629, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2026-27654, published 2026-03-24. High severity, CVSS 8.2. EPSS: 25.1% chance of exploitation in the next 30 days. NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may…
CVE-2026-42055, published 2026-06-17. High severity, CVSS 8.1. EPSS: 6.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or…
CVE-2026-42945, published 2026-05-13. High severity, CVSS 8.1. EPSS: 3.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an…
CVE-2025-23419, published 2025-02-05. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers.…
CVE-2026-9256, published 2026-05-22. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping…
CVE-2024-24989, published 2024-02-14. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default…
CVE-2026-27651, published 2026-03-24. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP…
CVE-2024-35200, published 2024-05-29. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.
CVE-2026-42946, published 2026-05-13. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is…

Latest

CVE-2026-97629, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL…
CVE-2026-97205, published 2026-10-14. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes…
CVE-2026-95101, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be…
CVE-2026-93479, published 2026-10-14. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before…
CVE-2026-15176, published 2026-10-14. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the…
CVE-2026-90439, published 2026-09-15. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer…
CVE-2026-60005, published 2026-07-15. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update…
CVE-2026-60065, published 2026-07-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond…
CVE-2026-56434, published 2026-07-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering…
CVE-2026-42533, published 2026-07-15. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map…