all quiet — no new nginx builds in 24 h; last 7 days: 3
yellow bar — appeared in the last 24 hours · red — a red rating
Critical · urgent · major — the vendor's top rating, or no rating while CVEs are listed: red pill and barImportant · high · medium — the vendor's second ratingModerate · medium · low — the vendor's other ratingsthe rating is the vendor's: AlmaLinux Critical / Important / Moderate, Low; Fedora and EPEL urgent / high / medium, low; Ubuntu (USN OVAL) Critical / High / Medium, Low; nginx.org major / medium / low; modules — CVSS from the CVE record critical / high / medium, low; PowerDNS Critical, High / Medium / LowUbuntu pockets: proposed — published for testing, updates — released, security — released as a security fixdefault — what dnf install nginx installs without choosing a stream
304AlmaLinux 8 · nginx · AppStream · checked · changed method conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day · rule every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
304AlmaLinux 8 · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
304AlmaLinux 9 · nginx · AppStream · checked · changed method conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day · rule every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
304AlmaLinux 9 · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
304AlmaLinux 10 · nginx · AppStream · checked · changed method conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day · rule every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
304AlmaLinux 10 · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
unchangedFedora · current release (Bodhi) · checked · changed method GET → JSON parsing; current is the newest Fedora release in state current · rule every 6 h
okFedora · nginx updates (Bodhi) · checked · changed method Bodhi API: updates of package nginx for the current release — when it entered testing and stable, type, rating, CVEs · rule every 15 min; Bodhi is down — the Packages/n/ listing of the repositories on Fedora mirrors
okUbuntu 24.04 LTS · nginx · Launchpad · checked · changed method Launchpad API (getPublishedSources): when the nginx source was published in proposed, updates and security, its status · rule every 15 min; the first time — a year of history; Launchpad is down — the archive's Release and Sources.xz (archive.ubuntu.com, security.ubuntu.com; sha256 from Release): a new kernel shows up with the Release time
304Ubuntu 24.04 LTS · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
okUbuntu · nginx notices (USN) · checked · changed method the notices RSS → JSON of new nginx notices → USN number, date, CVEs for the source version · rule every 30 min; the first time — 2 pages of notices.json per release; the rating comes from the USN OVAL
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
304Ubuntu noble · notice ratings (USN OVAL) · checked · changed method conditional GET of the release's USN OVAL (bz2) → Ubuntu's rating of every notice (Critical, High, Medium, Low) · rule every 6 h; ~1.3 MB, only when changed; shared by kernels and nginx
okUbuntu 26.04 LTS · nginx · Launchpad · checked · changed method Launchpad API (getPublishedSources): when the nginx source was published in proposed, updates and security, its status · rule every 15 min; the first time — a year of history; Launchpad is down — the archive's Release and Sources.xz (archive.ubuntu.com, security.ubuntu.com; sha256 from Release): a new kernel shows up with the Release time
304Ubuntu 26.04 LTS · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
okUbuntu · nginx notices (USN) · checked · changed method the notices RSS → JSON of new nginx notices → USN number, date, CVEs for the source version · rule every 30 min; the first time — 2 pages of notices.json per release; the rating comes from the USN OVAL
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
304Ubuntu resolute · notice ratings (USN OVAL) · checked · changed method conditional GET of the release's USN OVAL (bz2) → Ubuntu's rating of every notice (Critical, High, Medium, Low) · rule every 6 h; ~1.3 MB, only when changed; shared by kernels and nginx
fixed a memory leak when parsing malformed XML in the njs engine (CVE-2026-101025). Repeated malformed input could exhaust worker process memory. The issue was introduced in 9161a840 (0.7.10).
fixed incomplete XML attribute values containing entity references (CVE-2026-101019). JavaScript accessors could return values different from those used by XML canonicalization, affecting signed XML validation. The issue was introduced in 9161a840 (0.7.10).
fixed an access control bypass in js_access when an asynchronous request body continuation threw an exception or produced an unhandled rejection (CVE-2026-18329). Previously, nginx could continue processing the request as though the js_access check had succeeded. The issue was introduced in 0.9.9. T
fixed a worker process crash when reading Response.statusText after an upstream server returned a status line with an empty reason phrase (CVE-2026-78222). The issue was introduced in 73c75e41 (0.5.1).
fixed a heap buffer overflow while parsing namespace prefix lists passed to xml.exclusiveC14n() (CVE-2026-78689). The issue was introduced in 9161a840 (0.7.10). Thanks to Vladimir Vulnerability Research Tech Lead @ Cyera, evilgensec.
a heap buffer overflow might occur in a worker process when the js_fetch_proxy directive value contains nginx variables derived from the client request ( $http_*, $arg_*, $cookie_*, etc.) and the location's JS handler invokes ngx.fetch() (CVE-2026-8711). The issue was introduced in dea83189 (0.9.4).
high
sources and rules (2) · checked 4 min ago
304nginx.org · njs module (changes) · checked · changed method conditional GET → 'Security:' entries with CVEs; the rating comes from the CVE record (CVSS 3.1, else 4.0, by F5) · rule hourly
oknginx.org · acme module (releases) · checked · changed method GitHub API (conditional GET): nginx-acme releases whose notes name a CVE; the rating comes from the CVE record · rule hourly
Sources and liveness
Every source is a template: address, method, rule. Status is the last poll.
sources 18: ok 18, errors 0 · last check 0 min ago · show all
conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day
every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared)
every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day
every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared)
every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
conditional GET of the AppStream repomd.xml → on change: the Packages/ listing (when the nginx file appeared, module stream by version); modules.yaml (the default stream) and updateinfo.xml.gz (advisory, rating, CVEs; sha256 from repomd.xml) — when a new nginx build appeared, a build of the last 30 days waits for its advisory, or once a day
every 5 min; the official repository is down — AlmaLinux mirrors from the mirrorlist (https only, revision not older than already seen): builds from the advisories, time from the file's Last-Modified
conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared)
every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
Launchpad API (getPublishedSources): when the nginx source was published in proposed, updates and security, its status
every 15 min; the first time — a year of history; Launchpad is down — the archive's Release and Sources.xz (archive.ubuntu.com, security.ubuntu.com; sha256 from Release): a new kernel shows up with the Release time
conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared)
every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
Launchpad API (getPublishedSources): when the nginx source was published in proposed, updates and security, its status
every 15 min; the first time — a year of history; Launchpad is down — the archive's Release and Sources.xz (archive.ubuntu.com, security.ubuntu.com; sha256 from Release): a new kernel shows up with the Release time
conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared)
every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
vigil