FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

www/nginx -- Remote Code Execution/DoS

Affected packages
nginx < 1.30.1

Details

VuXML ID 3414ac89-4f9f-11f1-a1c0-0050569f0b83
Discovery 2026-05-14
Entry 2026-05-14

nginx development team reports:

When using the "proxy_set_body" directive, an attacker might inject data in the proxied request to an HTTP/2 backend

A heap memory buffer overflow might occur in a worker process while handling a specially crafted request by ngx_http_rewrite_module, potentially resulting in arbitrary code execution

A heap memory buffer overread might occur in a worker process while handling a specially crafted response by ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process

A heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process

When using HTTP/3, processing of connection migration might cause new QUIC streams to receive a new client address before validation, allowing an attacker to cause address spoofing

use-after-free might occur during DNS server response processing if the "ssl_ocsp" directive was used, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process

References

CVE Name CVE-2026-40460
CVE Name CVE-2026-40701
CVE Name CVE-2026-42926
CVE Name CVE-2026-42934
CVE Name CVE-2026-42945
CVE Name CVE-2026-42946