NGINX
NGINX is an HTTP server, reverse proxy, and load balancer. It is widely deployed as a frontend for application servers and as a TLS termination point. F5 Networks acquired nginx Inc. in 2019, after which NVD retagged most historical CVEs from the nginx:nginx namespace to f5:nginx. Attestd queries both namespaces to ensure complete coverage across all versions.
Querying NGINX
nginx1.27.4, 1.20.0, 1.24.0curl "https://api.attestd.io/v1/check?product=nginx&version=1.20.0" \
-H "Authorization: Bearer $ATTESTD_KEY"NGINX 1.20.0 returns risk_state: "critical". The aggregated set includes DNS resolver, HTTP/2, and later advisories with active exploitation signals. fixed_version is null until synthesis can name a single clear upgrade target.
{
"product": "nginx",
"version": "1.20.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"active_exploitation",
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": true,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2021-23017",
"CVE-2021-3618",
"CVE-2022-41741",
"CVE-2022-41742",
"CVE-2023-44487",
"CVE-2025-23419",
"CVE-2026-16993",
"CVE-2026-25552",
"CVE-2026-42055",
"CVE-2026-42533",
"CVE-2026-42945",
"CVE-2026-49972",
"CVE-2026-56434",
"CVE-2026-58467",
"CVE-2026-60005",
"CVE-2026-8430"
],
"cves": null,
"max_epss": 0.99999,
"last_updated": "2026-08-16T11:18:08.825063Z",
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null,
"source_published_at": null,
"observed_at": null,
"ingested_at": null,
"first_served_at": null,
"provenance": null
},
"supply_chain_monitored": true,
"typosquat": null
}Query the release you actually run. As of the last synthesis refresh, current mainline and stable tags (including 1.27.4) still return critical because several 2026 CVEs have no reliable fixed-version bound yet. Use the live response, not a static "known good" pin.
curl "https://api.attestd.io/v1/check?product=nginx&version=1.27.4" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
NGINX vulnerabilities cluster around three subsystems: the DNS resolver, HTTP/2 implementation, and optional media processing modules (mp4, image filter). The core HTTP/1.1 path has a strong security track record.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2021-23017 | Off-by-one error in the DNS resolver when processing oversized DNS responses. Allows heap write to attacker-controlled location. Requires the nginx resolver directive to be in use. | 0.6.18 to 1.20.0 | 7.7 |
CVE-2019-9511 | HTTP/2 data dribble attack. Remote attacker can force the server to queue large amounts of data by manipulating window sizes and stream priorities, consuming CPU and memory. | 1.9.5+ | 7.5 |
CVE-2019-9513 | HTTP/2 resource loop. Attacker sends requests that continuously reconfigure HTTP/2 stream priority trees, causing excessive CPU use and denial of service. | 1.9.5+ | 7.5 |
CVE-2022-41741 | Heap memory corruption in the NGINX mp4 module when processing specially crafted MP4 files. Can lead to code execution or crash. Only affects installations with the mp4 module compiled in. | 1.1.3 to 1.22.x | 7.8 |
CVE-2022-41742 | Memory disclosure via the mp4 module. A crafted MP4 file causes the worker process to read memory outside the intended buffer. Companion to CVE-2022-41741. | 1.1.3 to 1.22.x | 7.1 |
Post-acquisition namespace handling
F5 acquired nginx Inc. in 2019. NVD retagged most historical CVEs from the nginx:nginx CPE to f5:nginx. Some pre-2019 CVEs remain under the original namespace. Attestd queries both and merges on CVE ID:
cpe:2.3:a:f5:nginx2019 and later (post-acquisition)cpe:2.3:a:nginx:nginxPre-2019 (some records remain here)