NES for Ingress NGINX Release Notes

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.10

Helm Chart: HeroDevs/ingress-nginx --version 0.0.17 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.10 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

Go Toolchain

• CVE-2026-111943 — Go stdlib crypto/x509: Certificate.Verify did not reject a set of intermediate certificates that are no longer trustworthy. Go 1.26.10 adds a denylist so Verify returns an error for them, which protects systems whose trust stores were not updated. Fixed by GOLANG_VERSION 1.26.9 → 1.26.10. Reachability: Reachable only with --enable-ssl-chain-completion (off by default): internal/net/ssl.CreateSSLCert then calls fullChainCert, which runs x509.Certificate.Verify on each TLS Secret's certificate before fetching missing intermediates. govulncheck reports this path on Go 1.26.9 and nothing on Go 1.26.10.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.9

Helm Chart: HeroDevs/ingress-nginx --version 0.0.15 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.9 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

NGINX

• CVE-2026-97205 (8.1 (High; CVSS 3.1, F5 as CNA; 9.2 on CVSS 4.0; nginx rates Medium)) — Use-after-free with asynchronous file I/O. Each pending AIO or thread-pool operation holds a reference in the 8-bit r->main->blocked counter, and the increments were unchecked; with 256 operations pending on one request the counter wrapped to zero and the request could be freed while those operations still referenced its pool. Fixed upstream in nginx 1.31.7 / 1.30.6, released 2026-10-14. Patch: NES backport of upstream commit 6adfc05ece48 onto pinned 1.27.1. Reachability: Reachable only through a snippet — nginx.tmpl sets aio threads in the http block unconditionally, so the AIO half always holds, but more than 255 concurrent reads on one request needs something like SSI include virtual, and ssi on is not in the template.
• CVE-2026-95101 (5.3 (Medium; CVSS 3.1, F5 as CNA; 6.9 on CVSS 4.0)) — HTTP/3 request body injection. The parser stored the remaining length of a skipped unknown frame in the same field the request body filter reads as DATA payload length, so an unknown frame split across reads was passed on as request body, bypassing client_max_body_size or injecting unframed bytes into the proxied request. Fixed upstream in nginx 1.31.7 / 1.30.6. Patch: NES backport of upstream commit 1c173a2d8767 onto pinned 1.27.1. Reachability: Reachable only through a snippet — --with-http_v3_module is compiled in, but nginx.tmpl never configures a listen ... quic socket.
• CVE-2026-97629 (6.5 (Medium; CVSS 3.1, F5 as CNA; 8.3 on CVSS 4.0)) — TLS session ticket forgery. Automatic ticket key rotation synced only two of the three per-worker key slots from shared memory, leaving the third slot's name and keys uninitialized; a ticket naming that slot could be verified and decrypted with that material, allowing a forged session. Fixed upstream in nginx 1.31.7 / 1.30.6. Patch: NES backport of upstream commit 1916f26e6ca4 onto pinned 1.27.1. Reachability: Off by default — needs ssl-session-tickets: "true" (the template defaults to ssl_session_tickets off) and no ssl-session-ticket-key, since a key file disables automatic rotation.
• CVE-2026-93479 (8.1 (High; CVSS 3.1, F5 as CNA; 9.2 on CVSS 4.0; nginx rates Medium)) — Buffer overflow in script evaluation. After the CVE-2026-42533 bounds checks, ngx_http_script_run()/ngx_stream_script_run() could still let the result spill into the caller's reserved bytes when a variable grew between the length and value passes, and the recalculated length could then exceed the buffer. Affects document root from variables and access log paths with variables (http and stream). Fixed upstream in nginx 1.31.7 / 1.30.6. Patch: NES backport of upstream commit 6aa4b3fdd4fd onto pinned 1.27.1. Reachability: Limited — the document-root variant cannot be configured because ingress-nginx's 00_drop-alias-root.patch removes root and alias; an access_log path with variables (access-log-path ConfigMap key or a snippet) and a variable that changes between passes, such as a capture reset by a regex map, still reaches it.
• CVE-2026-15176 (8.1 (High; CVSS 3.1, F5 as CNA; 9.2 on CVSS 4.0; nginx rates Medium)) — Buffer overflow when using alias with rewrite. After a rewrite without break, URI-to-path mapping could run before a new location was chosen, overflowing when the location prefix was longer than the rewritten URI (for example via $request_filename). Fixed upstream in nginx 1.31.7 / 1.30.6. Patch: NES backport of upstream commit f8a23425bd68 onto pinned 1.27.1. Reachability: Not reachable — ingress-nginx's 00_drop-alias-root.patch removes the alias directive, so a configuration using it fails with unknown directive "alias" (checked against the patched binary).

Alpine Packages

• CVE-2025-60876 (Medium, CVSS 6.5) — busybox (Alpine apk, wget applet): BusyBox wget through 1.37 accepts raw CR/LF and other C0 control bytes (and a raw space) in the HTTP request-target, so an attacker-controlled URL can split the request line and inject headers (CWE-93). Fixed by None available — Alpine 3.24 still ships busybox 1.37.0-r31 with no secdb entry for this CVE, and edge has none either (checked 2026-09-21). Resolved as not_affected / vulnerable_code_not_in_execute_path in vex/openvex.json (was under_investigation since 2026-06-10, issue). Reachability: Not reachable — the vulnerable code is the busybox wget applet, which nothing in the image executes: nginx, the controller, and the OpenTelemetry exporter never shell out to it and no request path reaches it. Only an operator running kubectl exec with an operator-chosen URL can invoke it.
• CVE-2026-103111 (7.6 (High; CVSS v3.1, MITRE)) — pcre2 (Alpine apk, libpcre2-8): When JIT matching runs on a growable JIT stack (created with pcre2_jit_stack_create() and assigned with pcre2_jit_stack_assign()), a pattern that needs a single stack frame larger than the fixed 8 KiB growth step (for example ~1,400 referenced capturing groups with recursion) makes the generated code write below the JIT stack mapping, corrupting adjacent memory (CWE-787). Interpreter and DFA matching, and JIT matching on the default machine stack, are unaffected (PCRE2 advisory). Fixed by images/nginx-base/TAG v2.2.10-nes.10 → v2.2.10-nes.11 rebuild picks up pcre2 10.48-r0 → 10.49-r0 per Alpine v3.24 secdb (published for x86_64 and aarch64). Reachability: Not reachable — libpcre2-8 has been in the image only since v2.2.10-nes.10, for libmodsecurity 3.0.16; nginx, ngx.re and njs stay on legacy PCRE 8.x via --without-pcre2, and the ModSecurity connector module imports only legacy pcre_malloc/pcre_free. libmodsecurity imports pcre2_jit_compile/pcre2_jit_match but neither pcre2_jit_stack_create nor pcre2_jit_stack_assign (nm -D on the shipped v1.15.1-nes-1.15.8 image; same in the v3.0.16 source), so its JIT matching uses the default machine stack. Library CVE resolved by the version bump regardless.
• CVE-2026-35189 (Medium, CVSS 5.3) — openssl / libcrypto3: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions, so a crafted certificate from a malicious peer can cause memory pressure (DoS). OpenSSL rates it Low. Fixed by The same images/nginx-base/TAG v2.2.10-nes.10 → v2.2.10-nes.11 rebuild as CVE-2026-103111 above picks up openssl/libcrypto3/libssl3 3.5.8-r0 → 3.5.9-r0 (the nes.11 build log records Upgrading libcrypto3 (3.5.8-r0 -> 3.5.9-r0)). OpenSSL fixed the whole batch in 3.5.9; Alpine 3.24 published 3.5.9-r0 on 2026-09-30 but its secdb does not credit these CVEs yet, which is why Grype reported no fixed version and Trivy stayed silent. Reachability: Reachable only where nginx parses a certificate from an untrusted peer: client-certificate authentication (auth-tls-* annotations) or TLS to a malicious upstream. Low-severity memory pressure; library CVE resolved by the version bump regardless.
• CVE-2026-42772 (Medium, CVSS 5.3) — openssl / libcrypto3: OpenSSL QUIC stream reassembly degrades quadratically with out-of-order frames, so a peer that completes the handshake can cause connection-scoped CPU exhaustion with compliant STREAM frames. OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — the flaw is in OpenSSL's own QUIC stack, which nothing in the image instantiates: nginx implements its QUIC transport internally and uses OpenSSL only for handshake crypto (same as CVE-2026-14456 above); library CVE resolved by the version bump regardless.
• CVE-2026-54873 (High, CVSS 7.5) — openssl / libcrypto3: The OpenSSL QUIC stack keeps packet buffers alive until stream data is copied to the application, so a remote peer can make it hold packet-buffer memory for as long as it chooses (DoS). OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — same OpenSSL QUIC stack as CVE-2026-42772 above, which nothing in the image instantiates; library CVE resolved by the version bump regardless.
• CVE-2026-72897 (High, CVSS 7.5) — openssl / libcrypto3 / libssl3: A TLS server that switches a connection to a different SSL_CTX with SSL_set_SSL_CTX() mid-handshake may read, and in some cases write a fixed value, past an internal array when the replacement context knows more provider signature algorithms than the original (DoS). OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Unlikely — nginx does call SSL_set_SSL_CTX() from its SNI callback, but every SSL_CTX in the process is created from the same default library context with the same providers, so the replacement never knows more provider signature algorithms than the original; library CVE resolved by the version bump regardless.
• CVE-2026-75804 (Medium, CVSS 5.3) — openssl / libcrypto3: The OpenSSL QUIC stack does not enforce connection-level flow control for streams, letting a peer push ~100 MB instead of the 768 KiB default window. OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — same OpenSSL QUIC stack as CVE-2026-42772 above; library CVE resolved by the version bump regardless.
• CVE-2026-75805 (Medium, CVSS 5.3) — openssl / libcrypto3: A CMP client that requests revocation on the basis of a PKCS#10 CSR can dereference a NULL pointer on a crafted revocation response (DoS). OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — no CMP client runs in the image (same as CVE-2026-63074 above); library CVE resolved by the version bump regardless.
• CVE-2026-75806 (Medium, CVSS 5.3) — openssl / libssl3: A single unauthenticated datagram shorter than the explicit IV plus tag overhead tears down an established DTLS 1.2 association that uses an AEAD cipher suite (DoS limited to that association). OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — nothing in the image uses DTLS (same as CVE-2026-54874 above); library CVE resolved by the version bump regardless.
• CVE-2026-84782 (High, CVSS 8.2) — openssl / libssl3: DTLS retransmission mishandles a handshake-message write that was suspended part-way, so the retransmitted message can read past its buffer, disclosing heap memory to the peer or crashing. OpenSSL rates it High. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — nothing in the image uses DTLS: nginx has no DTLS support and the OTel exporter speaks TLS over TCP; library CVE resolved by the version bump regardless.
• CVE-2026-84784 (High, CVSS 7.5) — openssl / libcrypto3: A QUIC peer can flood NEW_CONNECTION_ID frames past the connection-ID limit; with ACKs withheld, the RETIRE_CONNECTION_ID backlog grows to ~400 MB (DoS). OpenSSL rates it Low. Fixed by Same 3.5.9-r0 rebuild as above. Reachability: Not reachable — same OpenSSL QUIC stack as CVE-2026-42772 above; library CVE resolved by the version bump regardless.
• CVE-2026-78689 (8.1 (High; CVSS 3.1, F5 as CNA; 9.2 on CVSS 4.0; njs rates major)) — njs (nginx-base, compiled from source): Heap buffer overflow while parsing the namespace prefix list passed to xml.exclusiveC14n(). Introduced in njs 0.7.10, fixed in njs 1.0.1. Scanners have no package metadata for from-source njs, so none flagged it; found while checking the nginx 1.30.6 batch. Fixed by images/nginx-base/rootfs/build.sh NJS_VERSION 0.9.0 → 1.0.2 (njs is compiled from source as a dynamic module, so no Alpine package is involved); images/nginx-base/TAG v2.2.10-nes.12 → v2.2.10-nes.13 rebuild. 1.0.2 is the first release that also fixes CVE-2026-101025/CVE-2026-101019 below. Verified: builds against our patched nginx 1.27.1 with the XML module enabled; a JS handler, XML parsing, attribute access and exclusive canonicalization return identical results under 0.9.0 and 1.0.2 (AddressSanitizer build, no reports). Behaviour changes since 0.9.0 (njs 1.0.0–1.0.2 CHANGES): exception classes aligned to TypeError/RangeError, stricter ngx.fetch() request validation, XML mutation rejects detached nodes and namespaced source trees. Reachability: Not reachable by default — ngx_http_js_module.so/ngx_stream_js_module.so are built but the template never loads them; exposure needs a main-snippet load_module plus js_import of customer JavaScript that passes attacker-influenced prefix lists to xml.exclusiveC14n(). Library CVE resolved by the version bump regardless.
• CVE-2026-78222 (7.5 (High; CVSS 3.1, F5 as CNA; 8.7 on CVSS 4.0)) — njs (nginx-base, compiled from source): Worker process crash when reading Response.statusText after an upstream answered an ngx.fetch() with an empty reason phrase. Introduced in njs 0.5.1, fixed in njs 1.0.1. Fixed by Same njs 1.0.2 bump as above. Reachability: Not reachable by default — ngx_http_js_module.so/ngx_stream_js_module.so are built but the template never loads them; exposure needs a main-snippet load_module plus js_import of customer JavaScript that calls ngx.fetch() against an attacker-controlled server and reads statusText. Library CVE resolved by the version bump regardless.
• CVE-2026-101025 (5.3 (Medium; CVSS 3.1, F5 as CNA; 6.9 on CVSS 4.0)) — njs (nginx-base, compiled from source): Memory leak when the njs engine parses malformed XML; repeated malformed input can exhaust worker memory. Introduced in njs 0.7.10, fixed in njs 1.0.2. Fixed by Same njs 1.0.2 bump as above. Reachability: Not reachable by default — ngx_http_js_module.so/ngx_stream_js_module.so are built but the template never loads them; exposure needs a main-snippet load_module plus js_import of customer JavaScript that parses attacker-supplied XML with the xml module. Library CVE resolved by the version bump regardless.
• CVE-2026-101019 (6.5 (Medium; CVSS 3.1, F5 as CNA; 8.3 on CVSS 4.0)) — njs (nginx-base, compiled from source): XML attribute values containing entity references were returned incompletely by the JavaScript accessors, so they could differ from the values used by XML canonicalization, which affects signed-XML validation. Introduced in njs 0.7.10, fixed in njs 1.0.2. Fixed by Same njs 1.0.2 bump as above. Reachability: Not reachable by default — ngx_http_js_module.so/ngx_stream_js_module.so are built but the template never loads them; exposure needs a main-snippet load_module plus js_import of customer JavaScript that validates signed XML with the xml module. Library CVE resolved by the version bump regardless.
• CVE-2026-85091 (7.4 (High; CVSS 3.1, VulnCheck as CNA; 8.3 on CVSS 4.0)) — zlib: zlib 1.3.1.2 through 1.3.2 can overflow a heap buffer in gz_vacate() when gzprintf()/gzvprintf() runs after a non-blocking gzwrite() stalled, because an unchecked memmove() writes past the internal input buffer. Grype flagged 1.3.2-r0 in nginx-base v2.2.10-nes.10 (issue, closed 2026-09-23 without a fix or row). Fixed by images/nginx-base/TAG v2.2.10-nes.11 → v2.2.10-nes.12 rebuild picks up zlib 1.3.2-r0 → 1.3.2-r1 (published 2026-10-06) per Alpine v3.24 secdb; the nes.12 build log records Upgrading zlib (1.3.2-r0 -> 1.3.2-r1). nes.11 (2026-10-02) predates the fix. Reachability: Unlikely — the flaw is in zlib's gzFile write path on a non-blocking descriptor; nginx's gzip and gunzip filters use the deflate()/inflate() stream API, not gzFile, and nothing on the request path writes gzip files through gzprintf(). Library CVE resolved by the version bump regardless.

Go Toolchain

• CVE-2026-94448 — Go stdlib html/template: Context tracking was not reset across consecutive template expressions, which can permit improper escaping. Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Not reachable — no shipped package imports html/template, and govulncheck finds no call path from cmd/internal/pkg.
• CVE-2026-97030 — Go stdlib html/template: yield was not recognized as a keyword that can precede a JavaScript regular expression, which can permit improper escaping. Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Not reachable — same as CVE-2026-94448 above.
• CVE-2026-78659 (High, CVSS 7.5) — Go stdlib net/http and golang.org/x/net/http2: An HTTP/2 server can be driven to memory exhaustion with Trailer headers. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9; golang.org/x/net v0.58.0 → v0.61.0 (sibling x/crypto/x/sys/x/text/x/term/x/sync/x/mod/x/tools modules bumped alongside). Reachability: Server-side path not exercised — govulncheck reaches the HTTP/2 symbols through the Kubernetes client transport, but the controller serves no HTTP/2: the admission webhook, its only TLS server, disables it with an empty TLSNextProto (internal/ingress/controller/nginx.go), and the metrics/health servers are plain HTTP/1.
• CVE-2026-56857 — Go stdlib os: Root.Mkdir/Root.MkdirAll can follow NTFS junctions out of the root on Windows. Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Not reachable — Windows-only; the controller runs on Linux only.
• CVE-2026-56866 (High, CVSS 7.5) — Go stdlib net/http: An HTTP/1 client connection can desynchronize after a proxy rejects its CONNECT request. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Reachable only behind an HTTPS proxy — controller status requests, the Kubernetes client, and certificate-chain retrieval use http.Client, which issues CONNECT only when an HTTPS_PROXY is configured and that proxy rejects the tunnel.
• CVE-2026-97031 (High, CVSS 7.5) — Go stdlib crypto/tls: Malformed Encrypted Client Hello outer-extension references were not rejected. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Low — every TLS handshake reaches the symbols, but nothing in the controller configures ECH keys or ECH config lists.
• CVE-2026-94440 (High, CVSS 7.5) — Go stdlib net/textproto, mime/multipart: MIME header parsing could bypass its memory limit. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Reachable — the metrics/health server (pkg/metrics.StartHTTPServer) parses request headers with textproto.Reader.ReadMIMEHeader, so any client that can reach that port can send them.
• CVE-2026-78667 — Go stdlib net/http: No limit on the size of parsed Range headers. Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Not reachable — the controller never serves files or content with Range support (http.ServeContent/ServeFile are unused), and govulncheck finds no call path.
• CVE-2026-78660 (High, CVSS 7.5) — Go stdlib net/http and golang.org/x/net/http2: The HTTP/2 transport accepted malformed framing-related headers. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9; golang.org/x/net v0.58.0 → v0.61.0. Reachability: Reachable, trusted peers only — controller status requests and the Kubernetes client use the HTTP/2 transport, but their peers are the local nginx status endpoint and the API server.
• CVE-2026-78669 (High, CVSS 7.5) — Go stdlib net/http and golang.org/x/net/http2: Repeated HTTP/2 initial-window-size changes cause excessive CPU consumption. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9; golang.org/x/net v0.58.0 → v0.61.0. Reachability: Low — reached only through the controller's outbound HTTP/2 connections, whose peer is the API server; the controller serves no HTTP/2 (see CVE-2026-78659 above).
• CVE-2026-78663 (Critical, CVSS 9.1) — Go stdlib net/http and golang.org/x/net/http2: An HTTP/2 server can refund connection-level flow control twice for the same data, letting a client bypass MaxReceiveBufferPerConnection. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9; golang.org/x/net v0.58.0 → v0.61.0. Reachability: Server-side path not exercised — same as CVE-2026-78659 above.
• CVE-2026-94439 (High, CVSS 7.5) — Go stdlib net/http: After a handler answers an HTTP/1 CONNECT with 2xx without hijacking, the server keeps reading HTTP requests from what the client treats as a tunnel, which can enable request smuggling through an intermediary. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9. Reachability: Low — no controller handler implements CONNECT, and exploiting the desync needs an intermediary proxy in front of the metrics/health port, which a standard deployment does not have.
• CVE-2026-97032 (High, CVSS 7.5) — Go stdlib net/http and golang.org/x/net/http2: An HTTP/2 server modifies its HPACK encoder from two goroutines without synchronization, so a client changing SETTINGS_HEADER_TABLE_SIZE while sending requests can crash it. (govulncheck) and (Grype). Fixed by GOLANG_VERSION 1.26.6 → 1.26.9; golang.org/x/net v0.58.0 → v0.61.0. Reachability: Server-side path not exercised — same as CVE-2026-78659 above.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.8

Helm Chart: HeroDevs/ingress-nginx --version 0.0.14 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.6 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

Alpine Packages

• CVE-2026-14456 (High, CVSS 7.5) — openssl / libcrypto3: An OpenSSL QUIC server (listener SSL object) processing valid QUIC Initial packets for unknown destination connection IDs allocates and queues new incoming channels without enforcing any limit, letting a remote peer drive unbounded memory growth (DoS). Fixed by images/nginx-base/TAG v2.2.10-nes.7 → v2.2.10-nes.8 rebuild picks up openssl/libcrypto3/libssl3 3.5.7-r0 → 3.5.8-r0 per Alpine v3.24 secdb. The same bump also covers CVE-2026-63073 and CVE-2026-75803, which secdb credits to 3.5.8-r0 but no scanner had flagged against our image at the time of the fix. Reachability: Not reachable — the flaw is in OpenSSL's own QUIC server stack (listener SSL objects), which nothing in the image instantiates: nginx implements its QUIC transport internally and uses OpenSSL only for handshake crypto; library CVE resolved by the version bump regardless.
• CVE-2026-14457 (High, CVSS 7.5) — openssl / libcrypto3: With RFC 7250 Raw Public Keys enabled and only a private key (no certificate) configured locally, a NULL pointer dereference can occur when the remote peer solicits raw public keys and also sends the normally omitted signature_algorithms_cert TLS extension (DoS). Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — nginx never enables RFC 7250 raw public keys, and every TLS context it creates is configured with a certificate; library CVE resolved by the version bump regardless.
• CVE-2026-18798 (Medium, CVSS 7.5) — openssl / libcrypto3: An OpenSSL QUIC server may trigger a double free when processing an INITIAL packet. Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — same OpenSSL QUIC server stack as CVE-2026-14456 above, which nothing in the image instantiates; library CVE resolved by the version bump regardless.
• CVE-2026-54874 (High, CVSS 7.5) — openssl / libcrypto3: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires (asymmetric resource consumption → DoS). Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — nothing in the image uses DTLS: nginx has no DTLS support and the OTel exporter speaks TLS over TCP; library CVE resolved by the version bump regardless.
• CVE-2026-63072 (Medium, CVSS 7.5) — openssl / libcrypto3: Heap buffer overflow in CMS key unwrapping. Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — CMS processing is not exercised by nginx, the controller, or the OTel exporter; library CVE resolved by the version bump regardless.
• CVE-2026-63074 (Medium, CVSS 5.9) — openssl / libcrypto3: The OpenSSL CMP implementation caches additional certificates (extraCerts) from CMP messages but never expunges them; a malicious client flooding a CMP server that reuses an OSSL_CMP_CTX can drive unbounded cache growth (DoS). Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — no CMP server or client runs in the image; library CVE resolved by the version bump regardless.
• CVE-2026-63075 (High, CVSS 7.5) — openssl / libcrypto3: A QUIC peer that repeatedly sends ack-eliciting packets while never acknowledging ACK-only responses makes the OpenSSL QUIC stack retain ACK-only packet metadata for the connection's lifetime (connection-scoped memory growth → DoS). Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — same OpenSSL QUIC stack as CVE-2026-14456 above, which nothing in the image instantiates; library CVE resolved by the version bump regardless.
• CVE-2026-63076 (Medium, CVSS 7.5) — openssl / libcrypto3: Invalid pointer dereference in a CMP server via a crafted protectionAlg. Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — no CMP server runs in the image; library CVE resolved by the version bump regardless.
• CVE-2026-63073 (Critical, CVSS 9.8) — openssl / libcrypto3: OpenSSL CMP response validation passes the peer-supplied sender distinguished name straight to ERR_raise_data() as the format string, so a malicious or intercepted CMP endpoint can send a DN like CN=%s%n that reaches BIO_vsnprintf() with no matching variadic arguments and crashes a CMP client that enforces an expected sender (CWE-134; rated Low by the OpenSSL project, 9.8 by NVD). Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — no CMP client (or server) runs in the image, same as CVE-2026-63074 above; library CVE resolved by the version bump regardless.
• CVE-2026-75803 (Low) — openssl / libcrypto3: ChaCha20-Poly1305 and AES-OCB decryption via the one-shot EVP_Cipher() API reports success without verifying the authentication tag when the ciphertext is empty, so callers relying on that return value may accept forged AEAD messages (CWE-354). Fixed by Same 3.5.8-r0 rebuild as above. Reachability: Not reachable — nothing in the image calls the one-shot EVP_Cipher() API for AEAD decryption: nginx's TLS record processing goes through libssl's standard update/final EVP flow, which verifies tags; library CVE resolved by the version bump regardless.
• CVE-2026-13608 (High, CVSS 7.4) — curl / libcurl: libcurl's SASL negotiation for LDAP authentication can misinterpret an incomplete handshake sequence as a successful cryptographic verification, so a man-in-the-middle can inject a premature or shortcut response that bypasses complete peer validation (curl advisory). Fixed by images/nginx-base/TAG v2.2.10-nes.8 → v2.2.10-nes.9 rebuild picks up curl/libcurl 8.21.0-r0 → 8.22.0-r0 per Alpine v3.24 secdb. The same bump also covers CVE-2026-80256, which secdb credits to 8.22.0-r0 but no scanner had flagged against our image at the time of the fix. Reachability: Not reachable — Alpine's curl is built without LDAP support (curl -V in the image lists no ldap/ldaps protocol), so the vulnerable SASL/LDAP code is not compiled in; the only libcurl consumers in the image (the OpenTelemetry C++ OTLP/HTTP and Zipkin exporters, and libmodsecurity's optional SecRemoteRules fetcher) speak HTTP(S) only. Library CVE resolved by the version bump regardless.
• CVE-2026-18924 (Critical, CVSS 9.1) — curl / libcurl: When a handle that receives HTTP/2 Server Push streams is set to share connections with other handles, the pushed streams can be freed while still referenced, leading to a use-after-free during cleanup (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — libcurl advertises SETTINGS_ENABLE_PUSH=0 and refuses pushed streams unless the application installs a CURLMOPT_PUSHFUNCTION callback; neither the OTel curl HTTP client nor libmodsecurity does, so no push stream ever reaches the vulnerable cleanup path. Library CVE resolved by the version bump regardless.
• CVE-2026-19931 (Critical, CVSS 9.8) — curl / libcurl: libcurl wrongly reuses an HTTP connection that was set up for a hostname with Negotiate authentication when the initial request used empty (ambient) credentials, so a later request by user B can be sent over user A's previously authenticated connection (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — Negotiate/SPNEGO is not even compiled into Alpine's curl (curl -V in the image lists no GSS-API, SPNEGO or Kerberos feature), and nothing in the image uses Negotiate authentication (same footprint as CVE-2026-5545 above). Library CVE resolved by the version bump regardless.
• CVE-2026-80229 (High, CVSS 7.5) — curl / libcurl: In multi-interface transfers with an OpenSSL 3 provider configuration, libcurl attaches an allocated OpenSSL library context to the easy handle without taking an ownership reference and hands it to a pooled TLS connection; destroying the easy handle early frees the context while the connection keeps a dangling pointer, causing a heap use-after-free on later I/O or post-handshake operations (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — libcurl only allocates that per-handle library context when the application loads its TLS client key through an OpenSSL provider (the PROV certificate type introduced in 8.14.0, the first affected release); neither the OTel curl HTTP client nor libmodsecurity uses provider-backed keys, and libmodsecurity uses the easy interface so no pooled connection outlives its handle. Library CVE resolved by the version bump regardless.
• CVE-2026-80230 (High, CVSS 7.5) — curl / libcurl: With CURLOPT_PINNEDPUBLICKEY configured alongside disabled peer/host verification, libcurl fails to enforce public key pinning on connections where the server presented no certificate, so a connection that should be rejected succeeds (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — neither libcurl consumer in the image sets CURLOPT_PINNEDPUBLICKEY: the OTel exporter's TLS options are CA/certificate-path based and libmodsecurity exposes no pinning option. Library CVE resolved by the version bump regardless.
• CVE-2026-80231 (High, CVSS 7.5) — curl / libcurl: libcurl reuses an existing HTTPS connection for a hostname even when the new transfer requests a different Native CA Store setting (CURLSSLOPT_NATIVE_CA) than the one the connection was created with (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — CURLSSLOPT_NATIVE_CA only takes effect on Windows (it selects the Windows certificate store) and neither consumer sets it; each libcurl consumer in the image uses a single static CA configuration, so no mixed-setting connection reuse can occur (same reasoning as CVE-2026-4873 above). Library CVE resolved by the version bump regardless.
• CVE-2026-80255 (High, CVSS 7.5) — curl / libcurl: A Set-Cookie: header that precedes the Secure attribute with a horizontal tab instead of a space makes curl store the cookie without its Secure flag, so it may later be sent over plaintext HTTP to the same host (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — no libcurl consumer in the image enables the cookie engine (no CURLOPT_COOKIEFILE/CURLOPT_COOKIEJAR/CURLOPT_COOKIELIST, same footprint as CVE-2025-14017 above), so Set-Cookie headers are never parsed or stored. Library CVE resolved by the version bump regardless.
• CVE-2026-80256 (Medium) — curl (wcurl): The wcurl wrapper script percent-decodes backslashes in a URL-derived output filename, letting a crafted URL place the downloaded file outside the directory the user chose on Windows (CWE-35, curl advisory). No scanner had flagged it against our image; Alpine secdb credits its fix to the same 8.22.0-r0 package as the rows above. Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — the flaw is Windows-only (backslash is not a path separator on Linux), and although Alpine's curl apk does ship /usr/bin/wcurl, nothing in the image invokes wcurl or the curl CLI at runtime: the curl package is present only as an apk dependency of libmaxminddb, not because anything in the build installs it.
• CVE-2026-82208 (High, CVSS 7.5) — curl / libcurl: With the wolfSSL backend and CA caching enabled, a CURLOPT_SSL_CTX_FUNCTION callback that replaces the trust store can be silently overridden when libcurl reinstalls the cached store, so a certificate rejected by the callback-selected store is wrongly accepted (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — Alpine's curl is built against OpenSSL (curl -V in the image reports OpenSSL/3.5.x); the wolfSSL backend is not compiled in. Library CVE resolved by the version bump regardless.
• CVE-2026-82209 (High, CVSS 8.2) — curl / libcurl: With libpsl support enabled, libcurl skips the Public Suffix List boundary check when a Set-Cookie Domain attribute exactly matches an origin host that is itself a public suffix (e.g. Domain=co.uk set by co.uk), storing a wildcard-scoped cookie that is then sent to arbitrary sibling domains under that suffix (curl advisory). Fixed by Same 8.22.0-r0 rebuild as above. Reachability: Not reachable — Alpine's libcurl does link libpsl, but no consumer in the image enables the cookie engine (same as CVE-2026-80255 above), so Set-Cookie headers are never stored. Library CVE resolved by the version bump regardless.
• CVE-2026-84304 (8.7 (High; CVSS v4.0, GitHub)) — grpc (Alpine apk, C++ gRPC): gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation, fixed in grpc-go 1.83.1. Grype matched the Go advisory against the Alpine grpc apk (1.78.1-r2) in nginx-base v2.2.10-nes.8 by package name. Fixed by Not applicable — wrong-package match; documented in OpenVEX as not_affected (component_not_present), same handling as CVE-2026-33186. The Go module google.golang.org/grpc is bumped to v1.83.1 separately in (Go Modules table above). Reachability: Not affected — the apk is Alpine's C++ gRPC client library (consumed by the OpenTelemetry C++ exporter), a separate codebase that does not contain the gRPC-Go transport; no Go gRPC code is linked into any shipped controller binary.
• CVE-2026-84303 (Medium, CVSS 6.3) — grpc (Alpine apk, C++ gRPC): gRPC-Go xDS RBAC HTTP filter does not lowercase header matcher names, so mixed-case DENY policies fail open; fixed in grpc-go 1.83.1. Same wrong-package match as CVE-2026-84304 above. Fixed by Not applicable — documented in OpenVEX as not_affected (component_not_present). Reachability: Not affected — same C++ gRPC library as above; no xDS RBAC filter is present or configured in the image.
• CVE-2026-30923 (7.5 (High; 8.2 CVSS v4.0, GitHub)) — libmodsecurity (nginx-base, compiled from source): Buffer overflow in hex_decode.cc: a rule that applies the t:hexDecode transformation to a query-string parameter containing a single character makes the worker segfault, so a remote client can crash nginx workers on demand (DoS) for as long as the requests keep coming. Fixed upstream in libmodsecurity v3.0.15. Surfaced by a customer inquiry: the image scanners see no package metadata for from-source components, so neither Trivy nor Grype had flagged it. Fixed by images/nginx-base/rootfs/build.sh MODSECURITY_LIB_VERSION v3.0.14 → v3.0.16 (libmodsecurity is compiled from source in nginx-base, so no Alpine package is involved); images/nginx-base/TAG v2.2.10-nes.9 → v2.2.10-nes.10 rebuild. v3.0.15+ dropped legacy PCRE, so the builder gains pcre2-dev and the runtime image pcre2; NGINX itself is pinned to legacy PCRE with --without-pcre2 so its regex engine is unchanged. --without-lua keeps parity with the v3.0.14 build, whose LuaJIT detection never actually succeeded. Reachability: Not reachable by default — ngx_http_modsecurity_module.so is loaded into every worker, but the engine is off unless enable-modsecurity is set (ConfigMap or annotation) and a rule uses t:hexDecode (OWASP CRS v4.22.0 does not; a modsecurity-snippet may). Any customer running the WAF with such a rule was exposed; library CVE resolved by the version bump regardless.
• CVE-2026-42268 (7.5 (High; 8.2 CVSS v4.0, GitHub)) — libmodsecurity (nginx-base, compiled from source): Unsigned-integer underflow in the @verifySSN, @verifyCPF and @verifySVNR operators throws an unhandled std::out_of_range, crashing the worker (DoS) when a rule uses one of them against attacker-controlled input. Affects libmodsecurity 3.0.0 – 3.0.14; fixed upstream in v3.0.15. Fixed by Same v3.0.16 bump as above. Reachability: Not reachable by default — same gating as CVE-2026-30923 above, and additionally requires a rule using one of the three @verify* operators (OWASP CRS v4.22.0 does not ship such a rule). Library CVE resolved by the version bump regardless.
• CVE-2026-52747 (High, CVSS 8.6) — libmodsecurity (nginx-base, compiled from source): The multipart/form-data request-body parser silently strips embedded CR/LF from non-file form-field values before exporting them to ARGS / ARGS_POST, while backend applications keep them, so a payload split across line breaks can evade every rule that inspects form arguments (WAF parser differential). Fixed upstream in libmodsecurity v3.0.16 (commit 875504c). Fixed by Same v3.0.16 bump as above. Reachability: Reachable when the WAF is enabled — every OWASP CRS request-inspection rule reads ARGS, so any customer with enable-modsecurity + enable-owasp-modsecurity-crs on could have had multipart payloads slip past CRS. Off by default; library CVE resolved by the version bump regardless.
• CVE-2026-52761 (Medium) — libmodsecurity (nginx-base, compiled from source): UTF-8 → Unicode conversion bug specific to the i386 architecture, fixed upstream in libmodsecurity v3.0.16 alongside CVE-2026-52747. Documented here because the same bump covers it; no scanner had flagged it. Fixed by Same v3.0.16 bump as above. Reachability: Not reachable — the defect is specific to 32-bit i386 builds; nginx-base ships only linux/amd64 and linux/arm64 images. Library CVE resolved by the version bump regardless.
• CVE-2025-9230 (7.5 (High; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. Fixed by Already fixed in the first NES image: Alpine credits the fix to openssl 3.5.4-r0 (aports 3.23-stable ec1ce97a, 2025-09-30), which predates the initial nginx-base build (cf39b8d, 2026-04-14, apk upgrade on Alpine 3.23). Confirmed ≥ 3.5.6-r0 in v2.2.10-nes.2 and 3.5.7-r0 in nes.3 ( rows above); the image ships 3.5.8-r0 since v2.2.10-nes.8. Documented now because a customer inquiry listed it and no scanner had ever flagged it against a shipped image. Reachability: Not reachable — CMS password-based decryption is not used by nginx, the controller or the OTel exporter; library CVE resolved by the version bump regardless.
• CVE-2025-15467 (8.8 (High; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. Fixed by Same as above — fixed in openssl 3.5.5-r0 (aports 9e1970e0, 2026-01-27), present since the first NES image. Reachability: Not reachable — CMS AuthEnvelopedData/EnvelopedData parsing is not exercised by anything in the image; library CVE resolved by the version bump regardless.
• CVE-2025-68160 (4.7 (Medium; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. Fixed by Same as above — fixed in openssl 3.5.5-r0 (aports 9e1970e0, 2026-01-27), present since the first NES image. Reachability: Not reachable — the BIO line-buffering filter (BIO_f_linebuffer) is not used by nginx's TLS stack; library CVE resolved by the version bump regardless.
• CVE-2025-69419 (7.4 (High; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Fixed by Same as above — fixed in openssl 3.5.5-r0 (aports 9e1970e0, 2026-01-27), present since the first NES image. Reachability: Not reachable — nothing in the image parses PKCS#12 files (nginx loads PEM certificates and keys); library CVE resolved by the version bump regardless.
• CVE-2025-69420 (7.5 (High; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Fixed by Same as above — fixed in openssl 3.5.5-r0 (aports 9e1970e0, 2026-01-27), present since the first NES image. Reachability: Not reachable — RFC 3161 TimeStamp response verification is not used by any component in the image; library CVE resolved by the version bump regardless.
• CVE-2025-69421 (High, CVSS 7.5) — openssl / libcrypto3 / libssl3: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. Fixed by Same as above — fixed in openssl 3.5.5-r0 (aports 9e1970e0, 2026-01-27), present since the first NES image. Reachability: Not reachable — nothing in the image parses PKCS#12 files; library CVE resolved by the version bump regardless.
• CVE-2026-2673 (6.5 (Medium; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable in practice — affects TLS 1.3 servers using the DEFAULT key-exchange group keyword; a downgrade to a less-preferred (still secure) group, not a compromise; library CVE resolved by the version bump regardless.
• CVE-2026-28387 (High, CVSS 8.1) — openssl / libcrypto3 / libssl3: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable — DANE TLSA-based server authentication is not enabled by nginx or the OTel exporter; library CVE resolved by the version bump regardless.
• CVE-2026-28388 (High, CVSS 7.5) — openssl / libcrypto3 / libssl3: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable — nginx does not process delta CRLs (ssl_crl loads plain CRLs and no delta CRL indicator handling is configured); library CVE resolved by the version bump regardless.
• CVE-2026-28389 (High, CVSS 7.5) — openssl / libcrypto3 / libssl3: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable — CMS EnvelopedData processing is not exercised by anything in the image; library CVE resolved by the version bump regardless.
• CVE-2026-28390 (High, CVSS 7.5) — openssl / libcrypto3 / libssl3: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable — CMS EnvelopedData processing is not exercised by anything in the image; library CVE resolved by the version bump regardless.
• CVE-2026-31789 (Critical, CVSS 9.8) — openssl / libcrypto3 / libssl3: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable — the OCTET STRING to hex conversion path is in ossl_* printing helpers not invoked by nginx's TLS handshake; treated as fixed by the version bump like the rest of the batch; library CVE resolved by the version bump regardless.
• CVE-2026-31790 (7.5 (High; CVSS v3.1, CISA-ADP)) — openssl / libcrypto3 / libssl3: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Fixed by Same as above — fixed in openssl 3.5.6-r0 (aports c630cf83, 2026-04-09), present since the first NES image. Reachability: Not reachable — RSASVE key encapsulation (EVP_PKEY_encapsulate with RSA) is not used by any component in the image; library CVE resolved by the version bump regardless.
• CVE-2025-9086 (7.5 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (path="/"). Fixed by Already fixed in the first NES image: Alpine credits the fix to curl 8.16.0-r0 (aports 3.23-stable fcf8bd81, 2025-09-10); the initial nginx-base build shipped 8.17.0-r1 ( row above) and the image ships 8.22.0-r0 today. Reachability: Not reachable — no libcurl consumer in the image enables the cookie engine (same footprint as CVE-2025-14017 above); library CVE resolved by the version bump regardless.
• CVE-2026-8286 (8.1 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. Fixed by Fixed by the v2.2.10-nes.6 nginx-base respin (cb8d8e3, 2026-07-06), the first build after Alpine credited the curl 8.21.0 advisory batch to curl 8.21.0-r0 (aports 3.24-stable 461165dc, 2026-06-30; the CVE-2026-11586 row above records 8.20.0-r1 → 8.21.0-r0 in that respin). First shipped in v1.15.1-nes-1.15.7; the image ships 8.22.0-r0 today. Documented now because a customer inquiry listed the batch. Reachability: Not reachable — no consumer in the image uses STARTTLS protocols (IMAP/SMTP/POP3/FTP); the OTel exporter and libmodsecurity speak HTTP(S) only; library CVE resolved by the version bump regardless.
• CVE-2026-8924 (9.1 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — the cookie engine is never enabled by any libcurl consumer in the image; library CVE resolved by the version bump regardless.
• CVE-2026-8925 (9.8 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — Alpine's curl is built without GSASL (curl -V lists no gsasl feature); library CVE resolved by the version bump regardless.
• CVE-2026-8926 (9.1 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specifi…. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — no consumer sets CURLOPT_NETRC; the curl CLI is present only as a libmaxminddb dependency and is never invoked; library CVE resolved by the version bump regardless.
• CVE-2026-8927 (9.1 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — the OTel exporter uses a fresh easy handle per export and libmodsecurity's SecRemoteRules fetch is one-shot; neither switches proxy environment configuration between transfers; library CVE resolved by the version bump regardless.
• CVE-2026-8932 (7.5 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — neither consumer changes mTLS options between transfers on a reused handle; library CVE resolved by the version bump regardless.
• CVE-2026-9079 (9.8 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — no consumer sets, let alone clears, proxy authentication credentials; library CVE resolved by the version bump regardless.
• CVE-2026-9080 (7.3 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — neither consumer uses the multi/event interface (CURLMOPT_SOCKETFUNCTION) or curl_easy_pause(); library CVE resolved by the version bump regardless.
• CVE-2026-9545 (7.5 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — Alpine's curl 8.19.0+ is built without HTTP/3 (aports b2e9306b "drop http3 support"), so no QUIC/HTTP3 code path exists in the image; library CVE resolved by the version bump regardless.
• CVE-2026-9546 (7.5 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. While the documentation states that passing NULL to CURLOPT_REFERER suppresses the header, the option failed to clear the internal state. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — no consumer sets or clears a Referer: header across reused transfers; library CVE resolved by the version bump regardless.
• CVE-2026-9547 (7.4 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — Alpine's curl has no libssh2/SCP/SFTP support and nothing in the image uses those schemes; library CVE resolved by the version bump regardless.
• CVE-2026-10536 (9.8 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — no consumer configures HTTP/2 stream dependencies (CURLOPT_STREAM_DEPENDS); library CVE resolved by the version bump regardless.
• CVE-2026-11352 (7.5 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams…. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — HTTP/3/QUIC is not compiled into Alpine's curl (see CVE-2026-9545); library CVE resolved by the version bump regardless.
• CVE-2026-11564 (9.1 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — connection-pool reuse across differing TLS/proxy settings requires a long-lived multi handle with varying options; neither consumer does this; library CVE resolved by the version bump regardless.
• CVE-2026-11856 (9.8 (Critical; CVSS v3.1, CISA-ADP)) — curl / libcurl: Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — no consumer uses Digest authentication; library CVE resolved by the version bump regardless.
• CVE-2026-12064 (7.5 (High; CVSS v3.1, CISA-ADP)) — curl / libcurl: When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOP…. Fixed by Same 8.21.0-r0 batch as above — fixed by the v2.2.10-nes.6 respin, first shipped in v1.15.1-nes-1.15.7. Reachability: Not reachable — affects the curl CLI with --proto-default sftp/scp; the CLI is never invoked and Alpine's curl has no SFTP/SCP support; library CVE resolved by the version bump regardless.
• CVE-2025-6021 (7.5 (High; CVSS v3.1, Red Hat)) — libxml2: A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. Fixed by Already fixed in the first NES image: Alpine credits the fix to libxml2 2.13.9-r0 (aports 3.23-stable 56c3dff2, 2025-09-09), seven months before the initial nginx-base build; the CVE-2026-6732 row above records 2.13.9-r1 in v2.2.10-nes.2 and the image ships 2.13.9-r2. Reachability: Not reachable in the default configuration — libxml2 is used only by libmodsecurity's XML request-body parser, which runs only when ModSecurity is enabled and the request body is XML; library CVE resolved by the version bump regardless.
• CVE-2025-49794 (9.1 (Critical; CVSS v3.1, Red Hat)) — libxml2: A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="."/> schema elements. Fixed by Same as above — fixed in libxml2 2.13.9-r0 (aports 56c3dff2, 2025-09-09), present since the first NES image. Reachability: Not reachable in the default configuration — XPath evaluation is only exercised by libmodsecurity's @validateSchema/XML variables when ModSecurity is enabled; library CVE resolved by the version bump regardless.
• CVE-2025-49795 (7.5 (High; CVSS v3.1, Red Hat)) — libxml2: A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. Fixed by Same as above — fixed in libxml2 2.13.9-r0 (aports 56c3dff2, 2025-09-09), present since the first NES image. Reachability: Same as above; library CVE resolved by the version bump regardless.
• CVE-2025-49796 (9.1 (Critical; CVSS v3.1, Red Hat)) — libxml2: A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data bein…. Fixed by Same as above — fixed in libxml2 2.13.9-r0 (aports 56c3dff2, 2025-09-09), present since the first NES image. Reachability: Same as above — Schematron (sch:) validation is never invoked by ModSecurity; library CVE resolved by the version bump regardless.
• CVE-2026-11979 (High, CVSS 7.8) — libxml2 (xmlcatalog CLI, package libxml2-utils): libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. The upstream fix (c2e233fc, 2026-05-22) changes xmlcatalog.c only; the maintainers dispute that it is a vulnerability. Not tracked by Alpine secdb. Fixed by Not applicable — the vulnerable binary is not in the image; documented in OpenVEX as not_affected (component_not_present), same handling as CVE-2026-33186. Reachability: Not affected — on Alpine /usr/bin/xmlcatalog ships in the libxml2-utils subpackage; the runtime stage installs only the libxml2 library package and libxml2-utils is absent from its dependency closure, so the --shell code path cannot execute in the shipped image.
• CVE-2026-0994 (High, CVSS 7.5) — protobuf (Alpine apk, C++ libprotobuf): A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. The upstream fix (protocolbuffers/protobuf#25239) changes python/google/protobuf/json_format.py and its test only. Fixed by Not applicable — Python-implementation flaw; documented in OpenVEX as not_affected (component_not_present), the same wrong-package handling as the grpc apk rows above. Reachability: Not affected — the image ships Alpine's C++ libprotobuf 31.1-r1 as a runtime dependency of grpc-cpp (OpenTelemetry C++ exporter); python3 and py3-protobuf are absent from the runtime dependency closure and no shipped component parses protobuf JSON.
• CVE-2026-40200 (8.1 (High; CVSS v3.1 per MITRE)) — musl: An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. Fixed by Already fixed in the first NES image: Alpine patched it in musl 1.2.6-r2 (aports 3.23-stable 8aef0c37, 2026-04-10 "main/musl: fix CVE-2026-40200"; 3.24-stable b0c8ea10, package built 2026-04-11), four days before the initial nginx-base build (cf39b8d, 2026-04-14); the row above notes the Alpine 3.24 rebuild picked up the musl baseline. The image ships 1.2.6-r2. Reachability: Not reachable in practice — requires a qsort comparison function that behaves inconsistently (a program bug); nginx, LuaJIT and the shipped modules call qsort with well-formed comparators. Library CVE resolved by the version bump regardless.
• CVE-2026-22184 (High, CVSS 7.8) — zlib: zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. Fixed by Already fixed in the first NES image: Alpine shipped zlib 1.3.2-r0 (aports 3.23-stable b9390f66, 2026-03-06) after first marking its build not-vulnerable (d323c1ad, 2026-01-26); the image ships 1.3.2-r0. Reachability: Not affected in substance — the flaw is in the untgz example utility under contrib/, which Alpine does not build or ship (only libz.so is packaged); nothing in the image contains that code. Version bump covers it regardless.

Go Toolchain

• CVE-2026-33818 (High, CVSS 7.5) — Go stdlib encoding/asn1: Unbounded recursion while decoding nested ASN.1 values can exhaust the stack. Tracks project items and. Fixed by GOLANG_VERSION 1.26.5 → 1.26.6. Reachability: Reachable — internal/net/ssl.parseSANExtension calls asn1.Unmarshal while processing certificates.
• CVE-2026-56859 (High, CVSS 7.5) — Go stdlib encoding/xml: Unbounded recursion while decoding nested XML values can exhaust the stack. Tracks project items and. Fixed by GOLANG_VERSION 1.26.5 → 1.26.6. Reachability: Materially present — vulnerable XML decoder symbols are embedded in the controller binary, although production-entrypoint govulncheck found no call path.
• CVE-2026-56853 (High, CVSS 7.5) — Go stdlib net/http: The unencrypted HTTP/2 protocol check did not apply ReadHeaderTimeout, permitting connections to consume server resources. Tracks project items and. Fixed by GOLANG_VERSION 1.26.5 → 1.26.6. Reachability: Reachable — the metrics and controller servers call http.Server.ListenAndServe and ListenAndServeTLS.
• CVE-2026-56862 (High, CVSS 7.5) — Go stdlib crypto/tls: TLS accepted an unbounded number of post-handshake messages, permitting memory or CPU exhaustion. Tracks project items and. Fixed by GOLANG_VERSION 1.26.5 → 1.26.6. Reachability: Reachable — controller logging, metrics, Kubernetes client, and internal status-request paths reach vulnerable TLS handshake/read/write symbols.
• CVE-2026-56858 (Medium, CVSS 6.1) — Go stdlib html/template: Incorrect JavaScript regular-expression context tracking can permit improper escaping. Tracks project item. Fixed by GOLANG_VERSION 1.26.5 → 1.26.6. Reachability: Materially present — vulnerable template execution symbols are embedded in the controller binary, although production-entrypoint govulncheck found no call path.
• CVE-2026-56860 (Medium, CVSS 5.9) — Go stdlib net/url: Path resolution can take quadratic time on crafted input. Tracks project items and. Fixed by GOLANG_VERSION 1.26.5 → 1.26.6. Reachability: Reachable — the controller's Kubernetes client call chain from cmd/nginx/main.go reaches url.URL.Parse.

Go Module Dependencies

• CVE-2026-41178 (Medium, CVSS 5.3) — go.opentelemetry.io/otel: Baggage parsing does not cap the raw header length, permitting excessive resource consumption. Version 1.42.0 fixed the first affected range, but the defect was reintroduced in 1.43.0. Tracks project item. Fixed by go.opentelemetry.io/otel v1.43.0 → v1.44.0. Reachability: Materially present — the module and vulnerable baggage symbols are embedded in the controller binary, although production-entrypoint govulncheck found no call path.
• CVE-2026-56865 (High, CVSS 8.4) — golang.org/x/mod/sumdb/tlog: Transparency-log tile verification can accept an invalid proof. Tracks project item. Fixed by Not applicable — x/mod v0.37.0 remains in the build/test graph and is documented in OpenVEX as not_affected (component_not_present). Reachability: Not affected — x/mod is pulled through Ginkgo/x/tools but is absent from all three shipped Go binaries and controller-image scanner artifacts.
• CVE-2026-56864 (High, CVSS 7.5) — golang.org/x/mod/sumdb: Lookup accepted unrelated, unauthenticated hashes from a checksum-database response. Tracks project item. Fixed by Not applicable — x/mod v0.37.0 remains in the build/test graph and is documented in OpenVEX as not_affected (component_not_present). Reachability: Not affected — x/mod is pulled through Ginkgo/x/tools but is absent from all three shipped Go binaries and controller-image scanner artifacts.
• CVE-2026-56854 — golang.org/x/crypto: Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.53.0 → v0.55.0 (sibling x/net/x/text/x/sys/x/term/x/sync/x/mod/x/tools modules bumped alongside). Reachability: Not reachable — controller is not an SSH server; govulncheck ./... reports the advisory at module level only, with no call path from any package, both before and after the bump.
• CVE-2026-56855 — golang.org/x/crypto: DoS on a deadlocked established channel in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.55.0 → v0.56.0. Reachability: Not reachable from the shipped binary — no package in cmd/internal/pkg imports x/crypto/ssh (go mod why reports the main module does not need the package; the module is required only for test-only bcrypt use in test/e2e/annotations), and govulncheck over the shipped trees reports no finding before or after the bump; the scheduled scan's call trace comes from the Linux-only ./... test graph. Library CVE resolved by the version bump regardless.
• CVE-2026-78662 — golang.org/x/crypto: DoS on a deadlocked undecided channel in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.55.0 → v0.56.0. Reachability: Not reachable from the shipped binary — same assessment as CVE-2026-56855 above; library CVE resolved by the version bump regardless.
• CVE-2026-84304 (8.7 (High; CVSS v4.0, GitHub)) — google.golang.org/grpc: gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation: an unauthenticated peer splits a stream's payload into millions of tiny (1-byte) DATA frames, each carrying per-frame tracking and queue overhead even inside the flow-control windows, so a handful of multiplexed streams can OOM the process (DoS). Fixed upstream by receive-buffer compaction in grpc-go 1.83.1. Dependabot alert. Fixed by google.golang.org/grpc v1.82.1 → v1.83.1 (google.golang.org/genproto/googleapis/rpc moves with it via go mod tidy). Reachability: Not reachable — same footprint as GHSA-hrxh-6v49-42gf above: grpc is a direct dependency but is imported only by the e2e suite, as a client (grpc.NewClient in test/e2e/annotations/grpc.go and test/e2e/settings/grpc.go); go list -deps finds no google.golang.org/grpc package in any cmd/... binary, so no shipped controller image ever contained the vulnerable transport. The Go vulnerability database had no entry for this CVE when the bump landed, so govulncheck cannot confirm it either way; the bump resolves the Dependabot alert regardless. The Alpine grpc apk in nginx-base is the C++ library and is out of scope for this Go-only advisory; Grype's mis-match of this CVE against that apk is handled by a not_affected VEX statement in .
• CVE-2026-84445 (High) — google.golang.org/grpc: gRPC-Go servers built with xds.NewGRPCServer() crash on a crafted request that carries neither :authority nor Host: the HTTP/2 server transport accepted such requests, the xDS routing interceptor then indexed an empty authorities slice, and because the per-RPC goroutine does not recover from panics the whole server process exited (DoS). Any peer that completes the transport handshake can trigger it. Fixed in grpc-go 1.83.2 (and 1.82.2). Dependabot alert. Fixed by google.golang.org/grpc v1.83.1 → v1.83.2 (golang.org/x/net v0.57.0 → v0.58.0 moves with it via go mod tidy). Reachability: Not reachable — same footprint as CVE-2026-84304 above: grpc is imported only by the e2e suite, as a client (grpc.NewClient in test/e2e/annotations/grpc.go and test/e2e/settings/grpc.go); nothing in the repo calls xds.NewGRPCServer, and go list -deps finds no google.golang.org/grpc package in any cmd/... binary, so no shipped controller image contains the vulnerable interceptor. govulncheck ./... on the bumped tree reports 0 vulnerabilities. The bump resolves the Dependabot alert regardless.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.7

Helm Chart: HeroDevs/ingress-nginx --version 0.0.9 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.5 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

NGINX

• CVE-2026-42533 (9.2 (Critical, CVSS 4.0; 8.1 High on CVSS 3.1)) — Heap buffer overflow in the script engine's capture-copy code (ngx_http_script.c / ngx_stream_script.c). A map directive's regex captures left e->end unbounded, so a later string expression built from a map-derived variable (or a non-cacheable variable used more than once) could copy past the destination buffer during the LEN/VALUE two-pass evaluation. Fixed upstream in nginx 1.31.3, released 2026-07-15. Patch: NES backport of the upstream "Script: buffer overrun protection" series (squashed: 28219209e0b4, b767540492e8, 25f920eca977, a8289aa69c74) onto pinned 1.27.1. Reachability: Reachable pre-auth — block-user-agents/block-referer annotations template regex map blocks (rootfs/etc/nginx/template/nginx.tmpl) matched against fully client-controlled User-Agent/Referer headers.
• CVE-2026-56434 (8.3 (High, CVSS 4.0; 6.5 Medium on CVSS 3.1)) — Use-after-free from duplicate subrequest finalization in ngx_http_request.c. A subrequest posted twice (once from ngx_http_subrequest(), once from ngx_http_postpone_filter() during SSI-include flushing) could be finalized twice, excessively decrementing r->main->count. Manifests in ngx_http_ssi_filter_module during unbuffered proxying. Fixed upstream in nginx 1.30.4, released 2026-07-15. Patch: NES backport of upstream commit 700dc9e0e750 onto pinned 1.27.1. Reachability: Reachable — ngx_http_ssi_filter_module is compiled in (not excluded in build.sh); reached via ssi on; through configuration-snippet/server-snippet annotations.
• CVE-2026-42946 (8.3 (Medium per Grype)) — Excessive memory allocation / over-read in ngx_http_scgi_module and ngx_http_uwsgi_module. On an invalid status line from the upstream, the parser fell back to header parsing without resetting r->state, letting parsing continue in the wrong state. Fixed upstream in nginx 1.31.0. Patch: Not applicable — build.sh compiles nginx with --without-http_scgi_module and --without-http_uwsgi_module; neither module exists in our binary, so there is no code to patch. Grype has flagged this repeatedly since 2026-05-28 via its nginx binary classifier; vex/openvex.json already carries the not_affected (vulnerable_code_not_present) statement. This row was just missing from this table until now — no new work, documentation catch-up only. Reachability: Not affected — both modules are excluded at compile time.
• CVE-2026-60005 (High, CVSS 8.8) — Uninitialized memory access in ngx_http_slice_module when the slice directive is combined with unnamed regex captures, or during a background cache update. Unauthenticated attackers can trigger limited memory disclosure or a worker restart. Data-plane only, no control-plane exposure. Fixed upstream in nginx 1.30.4 / 1.31.3, the same releases that fix CVE-2026-56434 and CVE-2026-42533 above. Flagged by Grype on 2026-07-21. Patch: Not applicable — ngx_http_slice_module requires the explicit --with-http_slice_module configure flag to build, and images/nginx-base/rootfs/build.sh's WITH_FLAGS list does not include it; the module is not compiled into our nginx binary. Documented in vex/openvex.json as not_affected (vulnerable_code_not_present), same justification as CVE-2026-42946 above (nginx itself is present, just missing this one module). Reachability: Not affected — the module is never compiled in.

Alpine Packages

• CVE-2026-33630 (High, CVSS 7.5) — c-ares: Use-after-free / double-free in query-completion handling. Fixed by images/nginx-base/TAG v2.2.10-nes.6 → v2.2.10-nes.7 rebuild picks up c-ares 1.34.6-r0 → 1.34.8-r0 per Alpine v3.24 secdb. Reachability: Indirect — c-ares is a transitive dependency of grpc-cpp (the OTel OTLP/gRPC exporter's async DNS resolver); not on the ingress client data path.
• CVE-2026-56289 (Medium, CVSS 5.5) — patch: GNU patch enters an effectively infinite loop on a crafted hunk with an out-of-range line offset, causing a DoS. Fixed upstream in commit faba04ef4f2b; no Alpine package carries the fix yet (still 2.8-r0 on 3.24 as of this scan). Fixed by removing the patch package from the final runtime stage of images/nginx-base/rootfs/Dockerfile instead of waiting on an Alpine backport. It's a build-time-only tool (build.sh applies our patch set with it during the builder stage) with zero runtime callers — confirmed via a repo-wide grep for patch invocations outside the build tooling — eliminating the CVE by removing the binary, not just marking it unreachable. Reachability: Not affected after the fix — the binary is no longer present in the shipped image.
• CVE-2026-56288 (Medium, CVSS 5.5) — patch: GNU patch passes a NULL pointer to fwrite() when consecutive end-of-file newline markers corrupt its internal hunk data, causing a crash. Fixed upstream in commit e6d6a4e02166; no Alpine package carries the fix yet. Fixed by the same fix as CVE-2026-56289 above: patch removed from the runtime stage of images/nginx-base/rootfs/Dockerfile. Reachability: Not affected after the fix — the binary is no longer present in the shipped image.

Go Toolchain

• CVE-2026-42505 (Medium, CVSS 5.3) — Go stdlib crypto/tls: Encrypted Client Hello handshakes disclosed pre-shared key identities in the unencrypted ClientHello, letting a passive network observer de-anonymize the connection. Fixed by GOLANG_VERSION 1.26.4 → 1.26.5. Reachability: Low — controller does not configure ECH; fixed regardless by the toolchain bump.
• CVE-2026-39822 (High, CVSS 7.8) — Go stdlib os: On Unix, os.Root follows a symlink outside the root when the final path component is a symlink ending in / (for example root.Open("symlink/")). Fixed by GOLANG_VERSION 1.26.4 → 1.26.5. Reachability: Low — controller does not use os.Root on attacker-influenced paths.

Go Module Dependencies

• CVE-2026-46600 — golang.org/x/net: Parsing an invalid SVCB or HTTPS resource record can panic in golang.org/x/net/dns/dnsmessage. Fixed by golang.org/x/net v0.55.0 → v0.56.0. Reachability: Not reachable — confirmed via govulncheck: dns/dnsmessage is present in the dependency graph but never called from cmd/nginx.
• CVE-2026-56852 — golang.org/x/text: Infinite loop on invalid input in golang.org/x/text/unicode/norm. Fixed by golang.org/x/text v0.37.0 → v0.39.0. Reachability: Reachable — confirmed via govulncheck: cmd/nginx/main.go's IngressClass lister call chain reaches norm.Form.Bytes/IsNormalString/QuickSpan/String.
• GO-2026-5932 (Informational) — golang.org/x/crypto: golang.org/x/crypto/openpgp and its subpackages are unmaintained and unsafe by design; the advisory carries no fixed version, on any release, ever. Fixed by None — no fixed version exists to bump to; no VEX entry either, since Grype has never flagged x/crypto/openpgp against our binary (matching how the other x/crypto rows above are handled). Reachability: Not affected — openpgp is never imported anywhere in this codebase (confirmed by grep); golang.org/x/crypto is pulled in for ssh/bcrypt/hkdf only.
• GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc: xDS RBAC and HTTP/2 vulnerabilities (Dependabot alert, no CVE assigned yet). Fixed by google.golang.org/grpc v1.79.3 → v1.82.1. Reachability: Low — a direct dependency, but only imported by test/e2e/annotations/grpc.go and test/e2e/settings/grpc.go; not reachable from the controller binary. Confirmed via govulncheck ./test/e2e/... clearing after the bump.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.6

Helm Chart: HeroDevs/ingress-nginx --version 0.0.9 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.4 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

NGINX

• CVE-2026-42055 (7.3 (High; nginx rates Medium)) — Heap buffer overflow when building the HTTP/2 upstream request. nginx reserves only NGX_HTTP_V2_INT_OCTETS (4) bytes for each HPACK field length; a field longer than NGX_HTTP_V2_MAX_FIELD (~2 MB) needs more length octets than were reserved, overflowing the upstream header buffer. Upstream fixes both ngx_http_grpc_module (grpc_pass) and ngx_http_proxy_v2_module (proxy_http_version 2); only the gRPC path exists in 1.27.1. Patch: NES backport of upstream commit 26d824e (fixed in nginx 1.31.2 mainline / 1.30.3 stable, released 2026-06-17) onto pinned 1.27.1. Reachability: Reachable only via gRPC backends — grpc_pass is generated by the backend-protocol: GRPC annotation. Exploitation additionally requires ignore-invalid-headers: "false" and large-client-header-buffers larger than 2 MB; neither is the default, so a stock deployment is not exposed. The proxy_http_version 2 path does not exist in 1.27.1.
• CVE-2026-48142 (Medium, CVSS 6.3) — Buffer over-read in ngx_http_charset_module (ngx_http_charset_recode_from_utf8). On an invalid UTF-8 sequence ngx_utf8_decode() stops advancing at the first invalid byte; the saved-sequence pointer was not advanced past it, allowing a 1-byte over-read. Triggered when a location has source_charset utf-8 and a charset directive. A follow-up to CVE-2026-42934 (006). Patch: NES backport of upstream commit 319a0bff (fixed in nginx 1.31.2 mainline / 1.30.3 stable, released 2026-06-17) onto pinned 1.27.1. Reachability: Reachable — ngx_http_charset_module is compiled in; charset / source_charset are reachable via configuration-snippet annotations. Same low-severity over-read class as 006.

Alpine Packages

• CVE-2026-6276 (High, CVSS 7.5) — curl / libcurl: Stale custom cookie host causes cookie leak — a custom Host: header combined with cookies can send cookies to the wrong host on connection reuse. NVD rates 7.5; the curl project rates severity Low. Tracked Alpine-blocked since v1.15.1-nes-1.15.5 (VEX under_investigation). Fixed by Alpine 3.24 switch: images/nginx-base/rootfs/Dockerfile pins alpine:3.24; images/nginx-base/TAG v2.2.10-nes.2 → v2.2.10-nes.3 rebuild picks up curl/libcurl 8.19.0-r0 → 8.20.0-r1 per Alpine secdb. Reachability: Unlikely — the OTel C++ exporter is the only libcurl consumer and does not set custom Host: headers with cookies; package version flagged by every scanner until this bump.
• CVE-2026-7009 (Medium, CVSS 5.3) — curl / libcurl: OCSP stapling (CURLOPT_SSL_VERIFYSTATUS) bypass in the Apple SecTrust (macOS Secure Transport) verification path. Tracked Alpine-blocked since v1.15.1-nes-1.15.5 (VEX under_investigation). Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — Apple SecTrust code is not compiled into Alpine's OpenSSL-backed curl, and the OTel exporter does not opt into CURLOPT_SSL_VERIFYSTATUS.
• CVE-2026-6732 (High, CVSS 7.5) — libxml2: Type confusion in XSD schema processing → DoS. Affects libxml2 ≥ 2.13.0; fixed upstream in 2.15.3. The Alpine 3.23-stable backport was contributed by NES (aports MRs !103117–!103120), landed as 2.13.9-r1, and is secdb-credited as of 2026-06-10 — meaning the v1.15.1-nes-1.15.5 image (which ships r1) is retroactively cleared by secdb-driven scanners. Tracked since v1.15.1-nes-1.15.5 (VEX under_investigation). Fixed by Same Alpine 3.24 rebuild as above (libxml2 2.13.9-r1 → 2.13.9-r2). Reachability: Unlikely — libxml2 is used by ModSecurity for HTML/XML request-body parsing, but XSD schema processing is not exercised by the default ingress-nginx configuration.
• CVE-2026-4873 (Medium, CVSS 5.9) — curl / libcurl: Connection reuse ignores TLS requirement — a connection established with weaker TLS requirements can be wrongly reused for a transfer that demanded stricter ones. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Unlikely — OTel exporter uses a single static TLS configuration, so no mixed-requirement reuse occurs.
• CVE-2026-5545 (Medium, CVSS 6.5) — curl / libcurl: Wrong reuse of HTTP Negotiate (SPNEGO/Kerberos) authenticated connection across credentials. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — the OTel exporter does not use Negotiate authentication.
• CVE-2026-5773 (High, CVSS 7.5) — curl / libcurl: Wrong reuse of SMB connection. NVD rates 7.5; the curl project rates severity Low. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — nothing in the controller or OTel exporter speaks SMB.
• CVE-2026-6253 (Medium, CVSS 5.9) — curl / libcurl: Proxy credentials leak over redirect-to proxy. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — OTel exporter does not configure HTTP proxies with credentials.
• CVE-2026-6429 (Medium, CVSS 5.3) — curl / libcurl: netrc credential leak with reused proxy connection. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — no .netrc usage in the controller image.
• CVE-2026-7168 (Medium, CVSS 5.3) — curl / libcurl: Cross-proxy Digest authentication state leak. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — OTel exporter does not use proxy Digest authentication.
• CVE-2026-34182 (Critical, CVSS 9.1) — openssl / libcrypto3: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-45447 (High, CVSS 8.8) — openssl / libcrypto3: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-7383 (High, CVSS 8.1) — openssl / libcrypto3: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-34180 (High, CVSS 7.5) — openssl / libcrypto3: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-34181 (High, CVSS 7.4) — openssl / libcrypto3: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-34183 (High, CVSS 7.5) — openssl / libcrypto3: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-42764 (High, CVSS 7.5) — openssl / libcrypto3: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-45445 (High, CVSS 7.5) — openssl / libcrypto3: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-9076 (High, CVSS 7.5) — openssl / libcrypto3: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-42766 (Medium, CVSS 5.9) — openssl / libcrypto3: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-42767 (Medium, CVSS 5.9) — openssl / libcrypto3: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-42769 (Medium, CVSS 5.3) — openssl / libcrypto3: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-45446 (Medium, CVSS 4.8) — openssl / libcrypto3: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
• CVE-2026-58055 (Medium, CVSS 6.3) — nghttp2-libs: nghttpx proxy forwards an HTTP/1.1 Upgrade request with a Content-Length body onto a reusable keep-alive backend connection, enabling request/response smuggling. No fixed Alpine package is available yet. Reachability: Not affected — nginx-base only installs nghttp2-libs (a transitive dependency of grpc-cpp, the runtime package used only by the OTel/OTLP exporter's outbound connections); the vulnerable nghttpx proxy binary itself is not installed, and nginx never proxies traffic through it.
• CVE-2026-11586 (High, CVSS 7.5) — curl / libcurl: WebSocket Auto-PONG memory exhaustion — curl auto-responds to WebSocket PING frames with no cap on unacknowledged-frame memory, letting a malicious server flood a curl-based WebSocket client's memory. Fixed by the nginx-base rebuild (curl/libcurl 8.20.0-r1 → 8.21.0-r0). Reachability: Not reachable — the OTel C++ exporter is the only libcurl consumer and exports over OTLP/gRPC and HTTP, never WebSocket.

Go Toolchain

• CVE-2026-39825 (Medium, CVSS 6.5) — Go stdlib net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls. Fixed by Go 1.26.3 (shipped via GOLANG_VERSION 1.26.4). Reachability: Not reachable: controller does not use net/http/httputil.ReverseProxy, and the 1.15.6 image is rebuilt with Go 1.26.4.
• CVE-2026-39823 (Medium, CVSS 5.4) — Go stdlib html/template: XSS via improper URL escaping in <meta> tag content. Fixed by Go 1.26.3 (shipped via GOLANG_VERSION 1.26.4). Reachability: Not reachable: controller does not render untrusted input through html/template, and the 1.15.6 image is rebuilt with Go 1.26.4.
• CVE-2026-42499 (High, CVSS 7.5) — Go stdlib net/mail: Denial of service via pathological email address parsing. Fixed by Go 1.25.10/1.26.3 (shipped via GOLANG_VERSION 1.26.4). Reachability: Not reachable: the 1.15.6 image is already rebuilt with Go 1.26.4, which supersedes the fix version.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.5

Helm Chart: HeroDevs/ingress-nginx --version 0.0.8 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.4 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.4)

This release patches the following CVEs:

NGINX

• CVE-2026-1642 (High, CVSS 7.5) — SSL upstream injection. When the read event handler fires before the write event handler on a backend connection, a quick plain-text response from an SSL-enabled upstream can be parsed prior to the SSL handshake, allowing an on-path attacker between NGINX and the upstream to inject cleartext into responses. Companion issue: bad-response reinit was missing, leaving stale upstream context (mixed responses, dangling ctx->connection in gRPC/proxy_v2 paths leading to UAF on next-upstream retry). Patch: NES backport of upstream nginx 1.29.5 commits a59f5f0 and d7a2494 onto pinned 1.27.1. Reachability: Reachable — proxy_ssl_verify is templated in rootfs/etc/nginx/template/nginx.tmpl and ingress users commonly proxy to TLS upstreams.
• CVE-2026-40460 (Medium, CVSS 5.3) — HTTP/3 QUIC address spoofing. When a client migrated to a new address, new QUIC streams received the unvalidated address before path validation completed, allowing an attacker to create QUIC streams with a spoofed source address (bypassing IP-based ACLs/rate-limits). Patch: NES backport of upstream nginx 1.30.1 commit 5461e8b onto pinned 1.27.1. Reachability: Reachable — --with-http_v3_module is enabled in build.sh; users can enable HTTP/3 listeners via configuration-snippet annotations.
• CVE-2026-40701 (Medium, CVSS 5.9) — OCSP resolver use-after-free. When a client SSL connection terminated (typically due to a timeout) while resolving an OCSP responder, the OCSP context was freed but the resolve context was not, causing a UAF on resolve completion. Patch: NES backport of upstream nginx 1.30.1 commit d2b8d47 onto pinned 1.27.1. Reachability: Reachable — ssl_verify_client is templated in nginx.tmpl; ssl_ocsp is not in the default template but is reachable via configuration-snippet/server-snippet annotations.
• CVE-2026-42934 (Medium, CVSS 5.3) — Buffer over-read in ngx_http_charset_module. When a multi-byte UTF-8 character was split across 3+ single-byte buffers, the saved-bytes continuation path called ngx_utf8_decode() with the wrong length and ngx_memcpy() read past the input buffer boundary. Patch: NES backport of upstream nginx 1.30.1 commit 54b7945 onto pinned 1.27.1. Reachability: Reachable — charset_map can be reached via configuration-snippet annotations with proxy_buffering off.

Go Toolchain

• CVE-2026-27145 — Go stdlib crypto/x509: Inefficient candidate hostname parsing leads to excessive CPU on crafted certificate chains. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — controller reads only its own client certs and the API server CA.
• CVE-2026-42504 — Go stdlib: Govulncheck-flagged stdlib advisory, fixed in 1.26.4. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — covered by Go toolchain bump alongside CVE-2026-27145.
• CVE-2026-42507 — Go stdlib: Govulncheck-flagged stdlib advisory, fixed in 1.26.4. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — covered by Go toolchain bump alongside CVE-2026-27145.
• GO-2026-5038 (High, CVSS 7.5) — Go stdlib net/mail: Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — controller does not parse external MIME headers.
• GO-2026-5039 — Go stdlib: Govulncheck-flagged stdlib advisory, fixed in 1.26.4. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — covered by Go toolchain bump.

Go Module Dependencies

• CVE-2026-39833 — golang.org/x/crypto: Key constraints not enforced in golang.org/x/crypto/ssh/agent. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — ingress controller does not act as an SSH agent; crypto/ssh/agent reachable only via transitive imports.
• CVE-2026-39832 — golang.org/x/crypto: Agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller does not forward SSH keys.
• CVE-2026-46597 — golang.org/x/crypto: Byte arithmetic underflow causes panic in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
• CVE-2026-39828 — golang.org/x/crypto: Bypass of certificate restrictions in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
• CVE-2026-39835 — golang.org/x/crypto: Server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server.
• CVE-2026-39827 — golang.org/x/crypto: Memory leak when rejecting channels → DoS in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
• CVE-2026-39830 — golang.org/x/crypto: Client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server.
• CVE-2026-39829 — golang.org/x/crypto: Pathological RSA/DSA parameters → DoS in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
• CVE-2026-39831 — golang.org/x/crypto: Bypass of FIDO/U2F security-keys physical-interaction in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Not reachable — controller does not perform interactive SSH auth.
• CVE-2026-39834 — golang.org/x/crypto: Infinite loop on large channel writes in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
• CVE-2026-42508 — golang.org/x/crypto: Auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Not reachable — controller does not use knownhosts.
• CVE-2026-46595 — golang.org/x/crypto: VerifiedPublicKeyCallback permissions skipped in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server.
• CVE-2026-46598 — golang.org/x/crypto: Pathological inputs can panic client in golang.org/x/crypto/ssh/agent. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller does not act as an SSH agent client.
• CVE-2026-39824 — golang.org/x/sys: Integer overflow in NewNTUnicodeString in golang.org/x/sys/windows. Fixed by golang.org/x/sys v0.43.0 → v0.45.0. Reachability: Not reachable — controller runs on Linux only.
• CVE-2026-42506 — golang.org/x/net: Incorrect handling of namespaced elements in foreign content in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework (httpexpect).
• CVE-2026-39821 — golang.org/x/net: Failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — idna.ToASCII reachable only from test/e2e framework.
• CVE-2026-42502 — golang.org/x/net: Incorrect handling of HTML elements in foreign content in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.
• CVE-2026-25680 — golang.org/x/net: Denial of service when parsing arbitrary HTML in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.
• CVE-2026-25681 — golang.org/x/net: Incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.
• CVE-2026-27136 — golang.org/x/net: Duplicate attributes can cause XSS in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.4

Helm Chart: HeroDevs/ingress-nginx --version 0.0.7 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.3 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.4)

This release backports the fix for CVE-2026-42945 ("NGINX Rift", CVSS 9.2, actively exploited in the wild) into the pinned NGINX 1.27.1 baseline. The NGINX base image rebuild also picks up Alpine 3.23.4 with newer curl/libcurl (8.19.0-r0), clearing five medium-severity curl CVEs along the way.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

NGINX

• CVE-2026-42945 (Critical, CVSS 9.2) — "NGINX Rift" — heap buffer overrun in ngx_http_script_regex_end_code (the ngx_http_rewrite_module script engine). A rewrite whose replacement contains args sets is_args and never clears it; subsequent set/if evaluations then apply URL-escaping to captures and the destination buffer is allocated without accounting for the escape expansion. Active in-the-wild exploitation confirmed by VulnCheck. DoS (worker crash) readily reachable; RCE requires ASLR disabled. Patch: NES backport of upstream commit 2046b45a (fixed in nginx 1.31.0 mainline / 1.30.1 stable, released 2026-05-13) onto pinned 1.27.1. Reachability: the vulnerable code path is on the hot path for nearly every deployment because rewrite-target, canary routing, and X-Forwarded-* handling all generate the trigger pattern.

Alpine Packages

• CVE-2025-14524 (Medium, CVSS 6.5) — curl/libcurl: OAuth2 bearer tokens leaked when an HTTP(S) request cross-protocol redirects to IMAP/LDAP/POP3/SMTP schemes. Fixed by rebuilding the NGINX base image (v2.2.9-nes.2 → v2.2.10-nes.1, Alpine 3.23.3 → 3.23.4, curl/libcurl 8.17.0-r1 → 8.19.0-r0). Not reachable — controller's curl usage is the OpenTelemetry C++ exporter only.
• CVE-2025-14819 (Medium, CVSS 6.8) — curl/libcurl: libcurl accidentally reuses a CA store cached in memory with the partial-chain option reversed, potentially accepting untrusted TLS certificates on subsequent connections with altered SSL settings. Fixed by the same rebuild. Not reachable — OTel exporter uses a single static TLS config.
• CVE-2026-1965 (Medium, CVSS 6.8) — curl/libcurl: libcurl incorrectly reuses authenticated connections with different credentials. Fixed by the same rebuild. Not reachable — OTel exporter uses a single static identity.
• CVE-2026-3784 (Medium, CVSS 6.5) — curl/libcurl: HTTP proxy connection reuse with mismatched credentials allows authentication bypass. Fixed by the same rebuild (applied to both nginx-base and controller images). Not reachable — neither image routes user traffic through an HTTP proxy via curl.
• CVE-2026-3805 (Medium, CVSS 6.3) — curl/libcurl: use-after-free in SMB request handling. Fixed by the same rebuild. Not reachable — controller does not use curl's SMB protocol support.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.3

Helm Chart: HeroDevs/ingress-nginx --version 0.0.5 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.3 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.3)

This release addresses CVE-2026-27135 in the nghttp2-libs Alpine package, four Go standard library advisories patched by upgrading the Go toolchain to 1.26.3, and an HTTP/2 transport vulnerability in golang.org/x/net patched by bumping that module to v0.53.0.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Alpine Packages

• CVE-2026-27135 (High, CVSS 7.5) — nghttp2-libs: Denial-of-service via malformed HTTP/2 frames after session termination. Fixed by rebuilding the NGINX base image with nghttp2-libs 1.68.1-r0 (v2.2.9-nes.2 NGINX base respin).

Go Toolchain

• GO-2026-4982 — html/template: Bypass of meta content URL escaping causes XSS. Fixed by upgrading Go 1.26.2 → 1.26.3.
• GO-2026-4980 — html/template: Escaper bypass leads to XSS. Fixed by upgrading Go 1.26.2 → 1.26.3.
• GO-2026-4971 — net: Panic in Dial and LookupPort when handling NUL byte on Windows. Fixed by upgrading Go 1.26.2 → 1.26.3. Not reachable in this build (controller runs on Linux only).
• GO-2026-4918 — net/http and golang.org/x/net: Infinite loop in HTTP/2 transport on bad SETTINGS_MAX_FRAME_SIZE. Fixed by upgrading Go 1.26.2 → 1.26.3 and golang.org/x/net v0.52.0 → v0.53.0.

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.2

Helm Chart: HeroDevs/ingress-nginx --version 0.0.2 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.2 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.3)

This release addresses multiple high-severity CVEs across the Go toolchain and Go module dependencies.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Go Toolchain

• CVE-2026-32282 — (Medium, CVSS 6.4) — Root.Chmod follows symlinks outside root via TOCTOU race on Linux (internal/syscall/unix). Fixed by upgrading Go 1.26.1 → 1.26.2.

Go Module Dependencies

• CVE-2024-44337 (Medium, CVSS 5.1) — github.com/gomarkdown/markdown: Infinite loop in paragraph parser causes denial-of-service. Bumped to patched version.
• CVE-2026-35204 (High, CVSS 8.4) — helm.sh/helm/v4: Path traversal in plugin version field allows arbitrary file write (CWE-22). Upgraded helm v4.1.3 → v4.1.4.
• CVE-2026-35205 (High, CVSS 8.4) — helm.sh/helm/v4: Missing .prov file check skips plugin signature verification, enabling arbitrary code execution (CWE-636). Upgraded helm v4.1.3 → v4.1.4.
• CVE-2026-40890 (High, CVSS 7.5) — github.com/gomarkdown/markdown: Out-of-bounds read/panic in SmartypantsRenderer on malformed < input. Bumped to patched version.