NGINX Inc. nginx

Name: NGINX Inc. nginx
Brand: NGINX Inc.

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

1critical13high8medium0low

updated 2026-10-27

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-7529US	high7.5	62.6% (99th)	Exploit	no fix	2017-07-13	2 versions
CVE-2019-9511US	high7.5	59.5% (99th)	Exploit	no fix	2019-08-13	≤ 1.17.3
CVE-2021-23017US	high7.7	53.5% (99th)	Exploit	no fix	2021-06-01	0.6.18 → 1.20.1
CVE-2018-16843US	high7.5	48.0% (99th)	Exploit	no fix	2018-11-07	2 versions
CVE-2026-49975US	—	33.0% (98th)	Exploit	no fix	2026-06-08	≤ 1.29.8
CVE-2019-20372US	medium5.3	15.0% (97th)	Exploit	no fix	2020-01-09	≤ 1.17.7
CVE-2016-0742US	high7.5	82.4% (100th)	—	no fix	2016-02-15	2 versions
CVE-2019-9516US	medium6.5	56.3% (99th)	—	no fix	2019-08-13	6 versions
CVE-2019-9518US	high7.5	25.4% (98th)	—	no fix	2019-08-13	≤ 1.17.3
CVE-2016-4450US	high7.5	16.4% (97th)	—	no fix	2016-06-07	2 versions
CVE-2018-16844US	high7.5	12.7% (96th)	—	no fix	2018-11-07	2 versions
CVE-2018-16845US	medium6.1	9.84% (96th)	—	no fix	2018-11-07	2 versions
CVE-2014-0133US	high7.5	9.55% (95th)	—	no fix	2014-03-28	2 versions
CVE-2014-0088US	high7.5	8.90% (95th)	—	no fix	2014-04-29	1.5.10 → 1.5.11
CVE-2014-3556US	medium6.8	7.83% (95th)	—	no fix	2014-12-29	2 versions
CVE-2017-20005US	critical9.8	3.26% (88th)	—	no fix	2021-06-06	≤ 1.13.6
CVE-2021-3618US	high7.4	2.03% (81st)	—	no fix	2022-03-23	≤ 1.21.0
CVE-2024-24989US	high7.5	1.06% (64th)	—	no fix	2024-02-14	1.25.0 → 1.25.3
CVE-2024-35200US	medium5.3	0.93% (60th)	—	no fix	2024-05-29	2 versions
CVE-2024-24990US	high7.5	0.91% (60th)	—	no fix	2024-02-14	1.25.0 → 1.25.3
CVE-2024-31079US	medium4.8	0.89% (59th)	—	no fix	2024-05-29	2 versions
CVE-2024-34161US	medium5.3	0.87% (58th)	—	no fix	2024-05-29	2 versions
CVE-2024-32760US	medium6.5	0.86% (58th)	—	no fix	2024-05-29	2 versions
CVE-2022-3638US	—	—	—	no fix	2022-10-21	≤ 1.23.2

showing 24 of 25

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption6 CVEs
CWE-404Improper Resource Shutdown or Release4 CVEs
CWE-476NULL Pointer Dereference4 CVEs
CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-787Out-of-bounds Write3 CVEs
CWE-190Integer Overflow or Wraparound2 CVEs
CWE-401Missing Release of Memory after Effective Lifetime2 CVEs
CWE-416Use After Free2 CVEs

sources (1)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)24 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan