In September 2026 Debian released an nginx update for both supported releases: DSA-6496-1 for Debian 13 (trixie) on 12 September and DLA-4784-1 for Debian 12 (bookworm) on 17 September. It fixes three vulnerabilities, one of which nginx rates "major", its highest category. A follow-up, DSA-6496-2, fixed a packaging regression on trixie four days later. This page also summarises the earlier nginx advisories of 2026.
At a glance
| Item | Details |
|---|---|
| Source package | nginx |
| Debian 13 (trixie) | 1.26.3-3+deb13u8 (DSA-6496-1), regression fix 1.26.3-3+deb13u9 (DSA-6496-2) |
| Debian 12 (bookworm) | 1.22.1-9+deb12u10 (DLA-4784-1) |
| CVEs | CVE-2026-42533 (major), CVE-2026-56434 (medium), CVE-2026-60005 (medium) |
| Severity | High (nginx rates CVE-2026-42533 major) |
| Newer update | Trixie has since received DSA-6575-1 (1.26.3-3+deb13u10, 21 Oct 2026) |
What the vulnerabilities are
Debian says these issues "may result in denial of service, memory disclosure or potentially the execution of arbitrary code".
- CVE-2026-42533, heap buffer overflow in the script engine (major). It can be triggered when a
mapdirective performs regular-expression matching and a string expression references captures modified by the map, or when non-cacheable variables change between the two passes nginx uses to build a string. F5, the CNA, scores it CVSS 3.1 8.1 with high attack complexity, and CISA's assessment on cve.org records a public proof of concept. It is not in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026. - CVE-2026-56434, use-after-free with server-side includes (medium). Seen in configurations that combine SSI with
proxy_passandproxy_buffering off, when an upstream response causes a subrequest to be finalised twice. - CVE-2026-60005, memory disclosure (medium). A regex match failure could leave stale capture information, so a later unnamed capture could read uninitialised memory. nginx lists it under the slice module.
The regression update, DSA-6496-2, affected only the nginx-dev package: the backported fix declared two private headers that nginx-dev does not ship, so third-party modules could no longer be built against it. If you compile your own nginx modules on trixie, make sure you have at least 1.26.3-3+deb13u9.
Earlier nginx advisories in 2026
| Advisory | Date | CVEs (nginx rating) | Debian 13 | Debian 12 |
|---|---|---|---|---|
| DSA-6131-1 | 12 Feb | CVE-2026-1642 (medium): injection when proxying to an upstream TLS server | 1.26.3-3+deb13u2 | 1.22.1-9+deb12u4 |
| DSA-6278-1 | 16 May | CVE-2026-42945 (medium), CVE-2026-40701 (medium), CVE-2026-42934 (low) | 1.26.3-3+deb13u5 | 1.22.1-9+deb12u7 |
| DSA-6326-1 | 7 Jun | CVE-2026-9256 (medium), CVE-2026-42946 (medium) | 1.26.3-3+deb13u6 | 1.22.1-9+deb12u8 |
| DSA-6374-1 / DLA-4667-1 | 30 Jun / 3 Jul | CVE-2026-42055 (medium), CVE-2026-48142 (low) | 1.26.3-3+deb13u7 | 1.22.1-9+deb12u9 |
Each nginx package includes all earlier fixes, so installing the newest version for your release covers every row.
Are you affected?
dpkg -l 'nginx*' 'libnginx-mod-*'
apt policy nginx nginx-commonOn Debian 12 you need at least 1.22.1-9+deb12u10. On Debian 13 you need at least 1.26.3-3+deb13u9 for this advisory, and 1.26.3-3+deb13u10 to include the October fixes. To see whether you use the features involved, search the full configuration:
sudo nginx -T 2>/dev/null | grep -nE '^\s*(map|ssi|proxy_buffering|slice)\b'A match is not proof of exposure, and no match is not a reason to skip the update; it only helps you prioritise. Debian 11 (bullseye) is past the end of LTS and should be upgraded.
How to update
sudo apt update
sudo apt upgradeBookworm receives LTS updates from the usual bookworm-security repository. Ubuntu builds differ; see Ubuntu Security Notices.
Restart or reboot?
No reboot is needed. Check the configuration and restart nginx so all worker processes run the fixed code:
sudo nginx -t
sudo systemctl restart nginxSources
- security-tracker.debian.org/tracker/DSA-6496-1
- debian.org/security/2026/dsa-6496
- lists.debian.org/debian-security-announce/2026/msg00407.html
- security-tracker.debian.org/tracker/DSA-6496-2
- lists.debian.org/debian-security-announce/2026/msg00411.html
- security-tracker.debian.org/tracker/DLA-4784-1
- lists.debian.org/debian-lts-announce/2026/09/msg00019.html
- security-tracker.debian.org/tracker/DSA-6131-1
- lists.debian.org/debian-security-announce/2026/msg00040.html
- security-tracker.debian.org/tracker/DSA-6278-1
- lists.debian.org/debian-security-announce/2026/msg00189.html
- security-tracker.debian.org/tracker/DSA-6326-1
- lists.debian.org/debian-security-announce/2026/msg00237.html
- security-tracker.debian.org/tracker/DSA-6374-1
- lists.debian.org/debian-security-announce/2026/msg00285.html
- security-tracker.debian.org/tracker/DLA-4667-1
- lists.debian.org/debian-lts-announce/2026/07/msg00008.html
- security-tracker.debian.org/tracker/DSA-6575-1
- nginx.org/en/security_advisories.html
- cve.org/CVERecord?id=CVE-2026-42533
- security-tracker.debian.org/tracker/nginx
- nginx.org/en/docs/switches.html
- wiki.debian.org/LTS/Using
Comments
0 total · 0 threads