#NGINX
All CosmicBytez Labs articles tagged #NGINX, across news, security advisories, how-to guides, and projects.
- News
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 patch five flaws — three CVSS 9.2 memory bugs with possible RCE and a TLS bug that may let attackers skip client-cert checks.
- HOWTO
Nginx + ModSecurity WAF: Protecting Web Apps with OWASP CRS
Deploy ModSecurity v3 as an Nginx module, wire in the OWASP Core Rule Set, tune false positives, and verify SQL injection and XSS are blocked — all on a...
- News
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
F5 has patched CVE-2026-42533, a critical heap buffer overflow in NGINX that allows unauthenticated remote attackers to crash worker processes and...
- Security
CVE-2026-42533: NGINX Memory Corruption via Map Directive Regex (CVSS 8.1)
A vulnerability in NGINX Plus and NGINX Open Source allows map directives using regex matching with capture variables to trigger memory corruption when...
- News
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution
F5 has released emergency security updates for two critical vulnerabilities in NGINX Open Source, including a CVSS 9.2 use-after-free flaw in the HTTP/3...
- News
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker
A heap buffer overflow in NGINX's rewrite module is under active exploitation, days after disclosure. The CVSS 9.2 flaw impacts both NGINX Plus and Open...
- News
PoC Code Published for Critical NGINX Vulnerability
A proof-of-concept exploit has been released for a critical-severity NGINX vulnerability that has existed in the rewrite module for nearly two decades....
- News
18-Year-Old NGINX Rewrite Module Flaw Enables
Researchers have disclosed multiple critical vulnerabilities in NGINX Plus and NGINX Open Source, including a heap buffer overflow in...
- News
18-Year-Old NGINX Vulnerability Allows DoS and Potential RCE
An autonomous scanning system has uncovered an 18-year-old flaw in the NGINX open-source web server that can be exploited for denial of service and, under...
- News
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables
A critical authentication bypass vulnerability in nginx-ui, a popular open-source web-based Nginx management interface, is being actively exploited to...
- Project
Build a Collaborative IPS with CrowdSec
Deploy CrowdSec on a Linux server to get community-powered intrusion prevention — block brute-force attacks, credential stuffing, and vulnerability...
- Security
CVE-2026-27651 — NGINX ngx_mail_auth_http_module NULL
When ngx_mail_auth_http_module is enabled with CRAM-MD5 or APOP authentication and the backend permits Auth-Wait retries, undisclosed requests can crash...
- Security
NGINX TLS Vulnerability Enables Man-in-the-Middle Attacks
CVE-2026-1642 affects NGINX OSS and Plus when proxying to upstream TLS servers, allowing attackers to inject plaintext data into responses.