Search for packages
| purl | pkg:deb/debian/nginx@1.22.1-9%2Bdeb12u3 |
| Next non-vulnerable version | 1.22.1-9+deb12u4 |
| Latest non-vulnerable version | 1.28.3-2 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2cu7-pyw5-t3dm
Aliases: CVE-2026-28753 |
Injection in auth_http and XCLIENT |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3czf-dtzg-8kdm
Aliases: CVE-2026-27651 |
NULL pointer dereference while using CRAM-MD5 or APOP |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-5781-s1ny-q7ey
Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p GMS-2023-3377 VSV00013 |
Affected by 0 other vulnerabilities. |
|
|
VCID-fmvd-vyt7-mkfk
Aliases: CVE-2026-27654 |
Buffer overflow in ngx_http_dav_module |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-kpjx-rrjs-subs
Aliases: CVE-2026-28755 |
OCSP result bypass in stream |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-sxf9-qr1j-u3et
Aliases: CVE-2026-27784 |
Buffer overflow in the ngx_http_mp4_module |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-z3xb-4krg-rbae
Aliases: CVE-2026-32647 |
Buffer overflow in the ngx_http_mp4_module |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-22cq-z7km-cfdc | SSL session reuse vulnerability |
CVE-2025-23419
|
| VCID-c4ta-jqmg-wfgf | lua-nginx-module: HTTP request smuggling via a crafted HEAD request |
CVE-2024-33452
|
| VCID-d1c6-dt2p-9kaa | SSL upstream injection |
CVE-2026-1642
|
| VCID-eb23-pd25-yqg3 | Buffer overread in the ngx_http_mp4_module |
CVE-2024-7347
|
| VCID-hemy-pnpj-sfg3 | Buffer overread in the ngx_mail_smtp_module |
CVE-2025-53859
|
| VCID-y3tg-7fge-1yfy | ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header. |
CVE-2020-36309
|