{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "nginx",
    "label": "nginx",
    "isStack": false,
    "url": "https://pwn.watch/t/nginx",
    "feed": "https://pwn.watch/t/nginx/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "nginx-october-2026-advisories",
      "title": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories",
      "json": "https://pwn.watch/i/nginx-october-2026-advisories.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "nginx",
      "tags": [
        "nginx",
        "http3",
        "tls"
      ],
      "cveIds": [
        "CVE-2026-15176",
        "CVE-2026-93479",
        "CVE-2026-95101",
        "CVE-2026-97629",
        "CVE-2026-97205"
      ],
      "affectedVersions": [
        "Varies per CVE; generally mainline before 1.31.7 and stable before 1.30.6"
      ],
      "fixedVersions": [
        "1.31.7+",
        "1.30.6+"
      ],
      "startedAt": "2026-10-14",
      "closedAt": "2026-10-14",
      "updatedAt": "2026-10-22T11:20:00+02:00",
      "summary": "nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.",
      "xPost": null
    },
    {
      "slug": "ingressnightmare-ingress-nginx-cve-2025-1974",
      "title": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)",
      "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974",
      "json": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Kubernetes ingress-nginx controller",
      "tags": [
        "hosting",
        "kubernetes",
        "nginx",
        "ingress-nginx",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-1974"
      ],
      "affectedVersions": [
        "< 1.11.0",
        "1.11.0-1.11.4",
        "1.12.0"
      ],
      "fixedVersions": [
        "1.11.5",
        "1.12.1"
      ],
      "startedAt": "2025-03-24",
      "closedAt": "2025-03-24",
      "updatedAt": "2025-03-24",
      "summary": "Wiz found that the ingress-nginx admission webhook could be made to load attacker config and run code, giving access to all cluster secrets the controller can read. CVSS 9.8. Fixed in controller v1.12.1 and v1.11.5; otherwise disable the validating webhook.",
      "xPost": null
    },
    {
      "slug": "http2-rapid-reset-ddos-cve-2023-44487",
      "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487",
      "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)",
      "tags": [
        "node",
        "go",
        "java",
        "dotnet",
        "http2",
        "ddos",
        "cloudflare",
        "google",
        "aws",
        "nginx",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-44487"
      ],
      "affectedVersions": [
        "Most HTTP/2 implementations; see each vendor's advisory"
      ],
      "fixedVersions": [
        "See vendor advisories (each HTTP/2 implementation shipped its own fix)"
      ],
      "startedAt": "2023-08-25",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Security advisories and patched releases published on nginx.org.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "nginx 1.31.8 mainline released.",
      "body": null,
      "sourceUrl": "https://nginx.org/",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-14",
      "title": "nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025.",
      "body": null,
      "sourceUrl": "https://nginx.org/",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "ingressnightmare-ingress-nginx-cve-2025-1974",
      "incidentTitle": "IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-24",
      "title": "Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare",
      "body": null,
      "sourceUrl": "https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/",
      "url": "https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-25",
      "title": "Cloudflare starts seeing unusually large HTTP/2 attacks",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    }
  ]
}