Home / mailings [SECURITY] [DSA 6496-1] nginx security update
Posted on 12 September 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6496-1 security@debian.org
https://www.debian.org/security/ Aron Xu
September 12, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : nginx
CVE ID : CVE-2026-42533 CVE-2026-56434 CVE-2026-60005
Multiple vulnerabilities were discovered in nginx, a high-performance web
and reverse proxy server, which may result in denial of service, memory
disclosure or potentially the execution of arbitrary code.
CVE-2026-42533
A heap buffer overflow was discovered in the nginx script engine. It
can be triggered when a map directive performs regular expression
matching and a string expression references captures modified by the
map, or when non-cacheable variables change between the script length
pass and the script copy pass.
CVE-2026-56434
Duplicate finalization of an HTTP subrequest can result in a
use-after-free. The issue is observable in configurations using
server-side includes together with proxy_pass and proxy_buffering
disabled, when an upstream response causes the same subrequest to be
posted twice.
CVE-2026-60005
ngx_http_regex_exec() could replace the captures array without
clearing r->ncaptures when the new regular expression did not match.
A subsequent unnamed capture could then access uninitialised memory,
resulting in memory disclosure.
For the stable distribution (trixie), these problems have been fixed in
version 1.26.3-3+deb13u8.
We recommend that you upgrade your nginx packages.
For the detailed security status of nginx please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nginx
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
