Multiple High Severity Vulnerabilities in NGINX – Remote Code Execution & DoS Risk

Overview

Multiple high-severity vulnerabilities have been identified in NGINX Open Source and NGINX Plus products. These vulnerabilities could allow attackers to execute arbitrary code, cause memory corruption, read sensitive memory data, bypass authorization, or crash the server resulting in a Denial of Service (DoS).

Since NGINX is commonly used as a web server, reverse proxy, load balancer, and API gateway, these vulnerabilities can have a serious impact on production environments, especially for internet-facing servers.

Organizations and individuals running affected versions of NGINX should review their systems and apply security updates as soon as possible.

---

Affected Software

The vulnerabilities affect the following versions:

NGINX Open Source

• Versions 1.0.0 to 1.29.6
• Versions 1.1.19 to 1.29.6
• Versions 0.5.13 to 0.9.7
• Versions 1.27.2 to 1.29.6
• Versions 0.6.27 to 0.9.7

NGINX Plus

• NGINX Plus R32 to R36

If your system is running any of the above versions, it may be vulnerable.

---

About NGINX

NGINX is a high-performance web server and reverse proxy server designed to handle a large number of simultaneous connections with low resource usage. It is widely used for:

• Serving static websites
• Reverse proxying applications
• Load balancing
• SSL/TLS termination
• API gateway
• Kubernetes Ingress
• Caching content

Because NGINX sits between users and backend servers, a vulnerability in NGINX can expose backend applications and infrastructure.

---

Vulnerability Details

The reported vulnerabilities are caused by multiple issues in NGINX modules and request processing logic. These include:

• Heap-based Buffer Overflow
• Integer Overflow or Wraparound
• Out-of-bounds Read
• NULL Pointer Dereference
• Incorrect Authorization
• Improper Neutralization of CRLF Sequences

If successfully exploited, these vulnerabilities could allow an attacker to:

• Execute arbitrary code
• Crash NGINX worker processes
• Read sensitive memory data
• Modify or access unauthorized resources
• Cause Denial of Service (DoS)
• Potentially compromise the server

---

CVE Identifiers

The vulnerabilities are tracked under the following CVEs:

• CVE-2026-27654
• CVE-2026-27784
• CVE-2026-32647
• CVE-2026-27651
• CVE-2026-28755
• CVE-2026-28753

These vulnerabilities affect different components and modules within NGINX.

---

Important Technical Clarification

It is very important to understand that not all vulnerabilities are exploitable in every NGINX installation by default.

Some vulnerabilities exist in specific NGINX modules such as WebDAV module, HTTP processing modules, or other optional modules. In many Linux distributions and Docker images, these modules are compiled into the NGINX binary but are not actively used unless they are enabled in the nginx.conf configuration file.

This means the risk depends on how NGINX is configured.

If a vulnerable module is compiled but not enabled in the configuration, the risk is lower, but not always zero. This is because some vulnerabilities such as buffer overflows, integer overflows, or out-of-bounds reads can sometimes be triggered during HTTP request parsing or early request processing stages. In such cases, an attacker may still be able to crash worker processes by sending specially crafted HTTP requests, resulting in Denial of Service.

If the vulnerable module is enabled and actively used in nginx.conf, then the risk becomes high and exploitation may lead to memory corruption or remote code execution depending on the vulnerability.

So even if you are not actively using certain modules, the vulnerable code may still exist in the compiled NGINX binary, and patching is still strongly recommended.

---

Risk Impact

Successful exploitation of these vulnerabilities could result in:

• Remote Code Execution
• Memory Corruption
• Unauthorized Access
• Information Disclosure
• Denial of Service (DoS)
• Service Downtime
• Backend Infrastructure Exposure

Servers that are internet-facing or used as reverse proxies for production applications are at higher risk.

---

How to Check Your NGINX Version

You can check your NGINX version using the following command:

nginx -v