DSA-6374-1 nginx - security update

highCVE-2026-42055 CVE-2026-48142

Multiple vulnerabilities were discoverd in Nginx, a high-performance web and reverse proxy server, which could result in remote code execution, denial of service or memory disclosure. https://security-tracker.debian.org/tracker/DSA-6374-1

CSIRTS triage

vendor: Nginx product: Nginx Remote code execution Denial of service Information disclosure

What: Multiple vulnerabilities in Nginx could lead to remote code execution, denial of service, or memory disclosure.
Who is affected: Deployments of Nginx are affected.
Urgency: High urgency for remediation due to the severity of the vulnerabilities.
Action: Apply the latest security update for Nginx.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Nginx

Get an email when a new Nginx advisory drops — max one per day, one-click unsubscribe.

Details

Source: Debian Security Advisories (INTL · vendor-psirt · site)
Severity: high
Published: 2026-06-30
Exploitation: Not in CISA KEV at last sync

Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00285.html

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-420554.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 90% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-481420.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-42055	coverage & exploitation status	NVD · CVE.org
CVE-2026-48142	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] NGINX and NGINX Plus: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in Microsoft Azure Linux (July 10, 2026)cert-fr-avis
highCVE-2026-42055: NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilitymsrc
mediumCVE-2026-48142: NGINX ngx_http_charset_module vulnerabilitymsrc