HeroDevs
Visit NES for Ingress NGINX Home Page

NES for Ingress NGINX Release Notes

Comprehensive release notes and changelog for NES for Ingress NGINX, including security patches, bug fixes, and feature updates across all supported versions.

89 Patched Vulnerabilities
VEX Statements

Ingress NGINX

1.15.7 (NES) - July 23, 2026

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.7

Helm Chart: HeroDevs/ingress-nginx --version 0.0.9 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.5 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

NGINX

  • CVE-2026-42533 (9.2 (Critical, CVSS 4.0; 8.1 High on CVSS 3.1)) — Heap buffer overflow in the script engine's capture-copy code (ngx_http_script.c / ngx_stream_script.c). A map directive's regex captures left e->end unbounded, so a later string expression built from a map-derived variable (or a non-cacheable variable used more than once) could copy past the destination buffer during the LEN/VALUE two-pass evaluation. Fixed upstream in nginx 1.31.3, released 2026-07-15. Patch: NES backport of the upstream "Script: buffer overrun protection" series (squashed: 28219209e0b4, b767540492e8, 25f920eca977, a8289aa69c74) onto pinned 1.27.1. Reachability: Reachable pre-auth — block-user-agents/block-referer annotations template regex map blocks (rootfs/etc/nginx/template/nginx.tmpl) matched against fully client-controlled User-Agent/Referer headers.
  • CVE-2026-56434 (8.3 (High, CVSS 4.0; 6.5 Medium on CVSS 3.1)) — Use-after-free from duplicate subrequest finalization in ngx_http_request.c. A subrequest posted twice (once from ngx_http_subrequest(), once from ngx_http_postpone_filter() during SSI-include flushing) could be finalized twice, excessively decrementing r->main->count. Manifests in ngx_http_ssi_filter_module during unbuffered proxying. Fixed upstream in nginx 1.30.4, released 2026-07-15. Patch: NES backport of upstream commit 700dc9e0e750 onto pinned 1.27.1. Reachability: Reachable — ngx_http_ssi_filter_module is compiled in (not excluded in build.sh); reached via ssi on; through configuration-snippet/server-snippet annotations.
  • CVE-2026-42946 (8.3 (Medium per Grype)) — Excessive memory allocation / over-read in ngx_http_scgi_module and ngx_http_uwsgi_module. On an invalid status line from the upstream, the parser fell back to header parsing without resetting r->state, letting parsing continue in the wrong state. Fixed upstream in nginx 1.31.0. Patch: Not applicable — build.sh compiles nginx with --without-http_scgi_module and --without-http_uwsgi_module; neither module exists in our binary, so there is no code to patch. Grype has flagged this repeatedly since 2026-05-28 via its nginx binary classifier; vex/openvex.json already carries the not_affected (vulnerable_code_not_present) statement. This row was just missing from this table until now — no new work, documentation catch-up only. Reachability: Not affected — both modules are excluded at compile time.
  • CVE-2026-60005 (High, CVSS 8.8) — Uninitialized memory access in ngx_http_slice_module when the slice directive is combined with unnamed regex captures, or during a background cache update. Unauthenticated attackers can trigger limited memory disclosure or a worker restart. Data-plane only, no control-plane exposure. Fixed upstream in nginx 1.30.4 / 1.31.3, the same releases that fix CVE-2026-56434 and CVE-2026-42533 above. Flagged by Grype on 2026-07-21. Patch: Not applicable — ngx_http_slice_module requires the explicit --with-http_slice_module configure flag to build, and images/nginx-base/rootfs/build.sh's WITH_FLAGS list does not include it; the module is not compiled into our nginx binary. Documented in vex/openvex.json as not_affected (vulnerable_code_not_present), same justification as CVE-2026-42946 above (nginx itself is present, just missing this one module). Reachability: Not affected — the module is never compiled in.

Alpine Packages

  • CVE-2026-33630 (High, CVSS 7.5) — c-ares: Use-after-free / double-free in query-completion handling. Fixed by images/nginx-base/TAG v2.2.10-nes.6 → v2.2.10-nes.7 rebuild picks up c-ares 1.34.6-r0 → 1.34.8-r0 per Alpine v3.24 secdb. Reachability: Indirect — c-ares is a transitive dependency of grpc-cpp (the OTel OTLP/gRPC exporter's async DNS resolver); not on the ingress client data path.
  • CVE-2026-56289 (Medium, CVSS 5.5) — patch: GNU patch enters an effectively infinite loop on a crafted hunk with an out-of-range line offset, causing a DoS. Fixed upstream in commit faba04ef4f2b; no Alpine package carries the fix yet (still 2.8-r0 on 3.24 as of this scan). Fixed by removing the patch package from the final runtime stage of images/nginx-base/rootfs/Dockerfile instead of waiting on an Alpine backport. It's a build-time-only tool (build.sh applies our patch set with it during the builder stage) with zero runtime callers — confirmed via a repo-wide grep for patch invocations outside the build tooling — eliminating the CVE by removing the binary, not just marking it unreachable. Reachability: Not affected after the fix — the binary is no longer present in the shipped image.
  • CVE-2026-56288 (Medium, CVSS 5.5) — patch: GNU patch passes a NULL pointer to fwrite() when consecutive end-of-file newline markers corrupt its internal hunk data, causing a crash. Fixed upstream in commit e6d6a4e02166; no Alpine package carries the fix yet. Fixed by the same fix as CVE-2026-56289 above: patch removed from the runtime stage of images/nginx-base/rootfs/Dockerfile. Reachability: Not affected after the fix — the binary is no longer present in the shipped image.

Go Toolchain

  • CVE-2026-42505 (Medium, CVSS 5.3) — Go stdlib crypto/tls: Encrypted Client Hello handshakes disclosed pre-shared key identities in the unencrypted ClientHello, letting a passive network observer de-anonymize the connection. Fixed by GOLANG_VERSION 1.26.4 → 1.26.5. Reachability: Low — controller does not configure ECH; fixed regardless by the toolchain bump.
  • CVE-2026-39822 (High, CVSS 7.8) — Go stdlib os: On Unix, os.Root follows a symlink outside the root when the final path component is a symlink ending in / (for example root.Open("symlink/")). Fixed by GOLANG_VERSION 1.26.4 → 1.26.5. Reachability: Low — controller does not use os.Root on attacker-influenced paths.

Go Module Dependencies

  • CVE-2026-46600 — golang.org/x/net: Parsing an invalid SVCB or HTTPS resource record can panic in golang.org/x/net/dns/dnsmessage. Fixed by golang.org/x/net v0.55.0 → v0.56.0. Reachability: Not reachable — confirmed via govulncheck: dns/dnsmessage is present in the dependency graph but never called from cmd/nginx.
  • CVE-2026-56852 — golang.org/x/text: Infinite loop on invalid input in golang.org/x/text/unicode/norm. Fixed by golang.org/x/text v0.37.0 → v0.39.0. Reachability: Reachable — confirmed via govulncheck: cmd/nginx/main.go's IngressClass lister call chain reaches norm.Form.Bytes/IsNormalString/QuickSpan/String.
  • GO-2026-5932 (Informational) — golang.org/x/crypto: golang.org/x/crypto/openpgp and its subpackages are unmaintained and unsafe by design; the advisory carries no fixed version, on any release, ever. Fixed by None — no fixed version exists to bump to; no VEX entry either, since Grype has never flagged x/crypto/openpgp against our binary (matching how the other x/crypto rows above are handled). Reachability: Not affected — openpgp is never imported anywhere in this codebase (confirmed by grep); golang.org/x/crypto is pulled in for ssh/bcrypt/hkdf only.
  • GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc: xDS RBAC and HTTP/2 vulnerabilities (Dependabot alert, no CVE assigned yet). Fixed by google.golang.org/grpc v1.79.3 → v1.82.1. Reachability: Low — a direct dependency, but only imported by test/e2e/annotations/grpc.go and test/e2e/settings/grpc.go; not reachable from the controller binary. Confirmed via govulncheck ./test/e2e/... clearing after the bump.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

1.15.6 (NES) - June 27, 2026

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.6

Helm Chart: HeroDevs/ingress-nginx --version 0.0.9 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.4 NGINX version: 1.27.1 (compiled from source on Alpine 3.24.0)

This release patches the following CVEs:

NGINX

  • CVE-2026-42055 (7.3 (High; nginx rates Medium)) — Heap buffer overflow when building the HTTP/2 upstream request. nginx reserves only NGX_HTTP_V2_INT_OCTETS (4) bytes for each HPACK field length; a field longer than NGX_HTTP_V2_MAX_FIELD (~2 MB) needs more length octets than were reserved, overflowing the upstream header buffer. Upstream fixes both ngx_http_grpc_module (grpc_pass) and ngx_http_proxy_v2_module (proxy_http_version 2); only the gRPC path exists in 1.27.1. Patch: NES backport of upstream commit 26d824e (fixed in nginx 1.31.2 mainline / 1.30.3 stable, released 2026-06-17) onto pinned 1.27.1. Reachability: Reachable only via gRPC backends — grpc_pass is generated by the backend-protocol: GRPC annotation. Exploitation additionally requires ignore-invalid-headers: "false" and large-client-header-buffers larger than 2 MB; neither is the default, so a stock deployment is not exposed. The proxy_http_version 2 path does not exist in 1.27.1.
  • CVE-2026-48142 (Medium, CVSS 6.3) — Buffer over-read in ngx_http_charset_module (ngx_http_charset_recode_from_utf8). On an invalid UTF-8 sequence ngx_utf8_decode() stops advancing at the first invalid byte; the saved-sequence pointer was not advanced past it, allowing a 1-byte over-read. Triggered when a location has source_charset utf-8 and a charset directive. A follow-up to CVE-2026-42934 (006). Patch: NES backport of upstream commit 319a0bff (fixed in nginx 1.31.2 mainline / 1.30.3 stable, released 2026-06-17) onto pinned 1.27.1. Reachability: Reachable — ngx_http_charset_module is compiled in; charset / source_charset are reachable via configuration-snippet annotations. Same low-severity over-read class as 006.

Alpine Packages

  • CVE-2026-6276 (High, CVSS 7.5) — curl / libcurl: Stale custom cookie host causes cookie leak — a custom Host: header combined with cookies can send cookies to the wrong host on connection reuse. NVD rates 7.5; the curl project rates severity Low. Tracked Alpine-blocked since v1.15.1-nes-1.15.5 (VEX under_investigation). Fixed by Alpine 3.24 switch: images/nginx-base/rootfs/Dockerfile pins alpine:3.24; images/nginx-base/TAG v2.2.10-nes.2 → v2.2.10-nes.3 rebuild picks up curl/libcurl 8.19.0-r0 → 8.20.0-r1 per Alpine secdb. Reachability: Unlikely — the OTel C++ exporter is the only libcurl consumer and does not set custom Host: headers with cookies; package version flagged by every scanner until this bump.
  • CVE-2026-7009 (Medium, CVSS 5.3) — curl / libcurl: OCSP stapling (CURLOPT_SSL_VERIFYSTATUS) bypass in the Apple SecTrust (macOS Secure Transport) verification path. Tracked Alpine-blocked since v1.15.1-nes-1.15.5 (VEX under_investigation). Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — Apple SecTrust code is not compiled into Alpine's OpenSSL-backed curl, and the OTel exporter does not opt into CURLOPT_SSL_VERIFYSTATUS.
  • CVE-2026-6732 (High, CVSS 7.5) — libxml2: Type confusion in XSD schema processing → DoS. Affects libxml2 ≥ 2.13.0; fixed upstream in 2.15.3. The Alpine 3.23-stable backport was contributed by NES (aports MRs !103117–!103120), landed as 2.13.9-r1, and is secdb-credited as of 2026-06-10 — meaning the v1.15.1-nes-1.15.5 image (which ships r1) is retroactively cleared by secdb-driven scanners. Tracked since v1.15.1-nes-1.15.5 (VEX under_investigation). Fixed by Same Alpine 3.24 rebuild as above (libxml2 2.13.9-r1 → 2.13.9-r2). Reachability: Unlikely — libxml2 is used by ModSecurity for HTML/XML request-body parsing, but XSD schema processing is not exercised by the default ingress-nginx configuration.
  • CVE-2026-4873 (Medium, CVSS 5.9) — curl / libcurl: Connection reuse ignores TLS requirement — a connection established with weaker TLS requirements can be wrongly reused for a transfer that demanded stricter ones. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Unlikely — OTel exporter uses a single static TLS configuration, so no mixed-requirement reuse occurs.
  • CVE-2026-5545 (Medium, CVSS 6.5) — curl / libcurl: Wrong reuse of HTTP Negotiate (SPNEGO/Kerberos) authenticated connection across credentials. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — the OTel exporter does not use Negotiate authentication.
  • CVE-2026-5773 (High, CVSS 7.5) — curl / libcurl: Wrong reuse of SMB connection. NVD rates 7.5; the curl project rates severity Low. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — nothing in the controller or OTel exporter speaks SMB.
  • CVE-2026-6253 (Medium, CVSS 5.9) — curl / libcurl: Proxy credentials leak over redirect-to proxy. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — OTel exporter does not configure HTTP proxies with credentials.
  • CVE-2026-6429 (Medium, CVSS 5.3) — curl / libcurl: netrc credential leak with reused proxy connection. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — no .netrc usage in the controller image.
  • CVE-2026-7168 (Medium, CVSS 5.3) — curl / libcurl: Cross-proxy Digest authentication state leak. Fixed by Same Alpine 3.24 rebuild as above. Reachability: Not reachable — OTel exporter does not use proxy Digest authentication.
  • CVE-2026-34182 (Critical, CVSS 9.1) — openssl / libcrypto3: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-45447 (High, CVSS 8.8) — openssl / libcrypto3: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-7383 (High, CVSS 8.1) — openssl / libcrypto3: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-34180 (High, CVSS 7.5) — openssl / libcrypto3: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-34181 (High, CVSS 7.4) — openssl / libcrypto3: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-34183 (High, CVSS 7.5) — openssl / libcrypto3: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-42764 (High, CVSS 7.5) — openssl / libcrypto3: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-45445 (High, CVSS 7.5) — openssl / libcrypto3: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-9076 (High, CVSS 7.5) — openssl / libcrypto3: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-42766 (Medium, CVSS 5.9) — openssl / libcrypto3: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-42767 (Medium, CVSS 5.9) — openssl / libcrypto3: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-42769 (Medium, CVSS 5.3) — openssl / libcrypto3: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-45446 (Medium, CVSS 4.8) — openssl / libcrypto3: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Fixed by Alpine 3.24 switch (openssl/libcrypto3/libssl3 3.5.6-r0 → 3.5.7-r0); the nginx-base v2.2.10-nes.3 image ships 3.5.7-r0, confirmed by apk info -v. Reachability: Library CVE in libcrypto3, linked by NGINX (TLS) and the OTel exporter; resolved by the version bump regardless of reachability.
  • CVE-2026-58055 (Medium, CVSS 6.3) — nghttp2-libs: nghttpx proxy forwards an HTTP/1.1 Upgrade request with a Content-Length body onto a reusable keep-alive backend connection, enabling request/response smuggling. No fixed Alpine package is available yet. Reachability: Not affected — nginx-base only installs nghttp2-libs (a transitive dependency of grpc-cpp, the runtime package used only by the OTel/OTLP exporter's outbound connections); the vulnerable nghttpx proxy binary itself is not installed, and nginx never proxies traffic through it.
  • CVE-2026-11586 (High, CVSS 7.5) — curl / libcurl: WebSocket Auto-PONG memory exhaustion — curl auto-responds to WebSocket PING frames with no cap on unacknowledged-frame memory, letting a malicious server flood a curl-based WebSocket client's memory. Fixed by the nginx-base rebuild (curl/libcurl 8.20.0-r1 → 8.21.0-r0). Reachability: Not reachable — the OTel C++ exporter is the only libcurl consumer and exports over OTLP/gRPC and HTTP, never WebSocket.

Go Toolchain

  • CVE-2026-39825 (Medium, CVSS 6.5) — Go stdlib net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls. Fixed by Go 1.26.3 (shipped via GOLANG_VERSION 1.26.4). Reachability: Not reachable: controller does not use net/http/httputil.ReverseProxy, and the 1.15.6 image is rebuilt with Go 1.26.4.
  • CVE-2026-39823 (Medium, CVSS 5.4) — Go stdlib html/template: XSS via improper URL escaping in <meta> tag content. Fixed by Go 1.26.3 (shipped via GOLANG_VERSION 1.26.4). Reachability: Not reachable: controller does not render untrusted input through html/template, and the 1.15.6 image is rebuilt with Go 1.26.4.
  • CVE-2026-42499 (High, CVSS 7.5) — Go stdlib net/mail: Denial of service via pathological email address parsing. Fixed by Go 1.25.10/1.26.3 (shipped via GOLANG_VERSION 1.26.4). Reachability: Not reachable: the 1.15.6 image is already rebuilt with Go 1.26.4, which supersedes the fix version.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

1.15.5 (NES) - June 10, 2026

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.5

Helm Chart: HeroDevs/ingress-nginx --version 0.0.8 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.4 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.4)

This release patches the following CVEs:

NGINX

  • CVE-2026-1642 (High, CVSS 7.5) — SSL upstream injection. When the read event handler fires before the write event handler on a backend connection, a quick plain-text response from an SSL-enabled upstream can be parsed prior to the SSL handshake, allowing an on-path attacker between NGINX and the upstream to inject cleartext into responses. Companion issue: bad-response reinit was missing, leaving stale upstream context (mixed responses, dangling ctx->connection in gRPC/proxy_v2 paths leading to UAF on next-upstream retry). Patch: NES backport of upstream nginx 1.29.5 commits a59f5f0 and d7a2494 onto pinned 1.27.1. Reachability: Reachable — proxy_ssl_verify is templated in rootfs/etc/nginx/template/nginx.tmpl and ingress users commonly proxy to TLS upstreams.
  • CVE-2026-40460 (Medium, CVSS 5.3) — HTTP/3 QUIC address spoofing. When a client migrated to a new address, new QUIC streams received the unvalidated address before path validation completed, allowing an attacker to create QUIC streams with a spoofed source address (bypassing IP-based ACLs/rate-limits). Patch: NES backport of upstream nginx 1.30.1 commit 5461e8b onto pinned 1.27.1. Reachability: Reachable — --with-http_v3_module is enabled in build.sh; users can enable HTTP/3 listeners via configuration-snippet annotations.
  • CVE-2026-40701 (Medium, CVSS 5.9) — OCSP resolver use-after-free. When a client SSL connection terminated (typically due to a timeout) while resolving an OCSP responder, the OCSP context was freed but the resolve context was not, causing a UAF on resolve completion. Patch: NES backport of upstream nginx 1.30.1 commit d2b8d47 onto pinned 1.27.1. Reachability: Reachable — ssl_verify_client is templated in nginx.tmpl; ssl_ocsp is not in the default template but is reachable via configuration-snippet/server-snippet annotations.
  • CVE-2026-42934 (Medium, CVSS 5.3) — Buffer over-read in ngx_http_charset_module. When a multi-byte UTF-8 character was split across 3+ single-byte buffers, the saved-bytes continuation path called ngx_utf8_decode() with the wrong length and ngx_memcpy() read past the input buffer boundary. Patch: NES backport of upstream nginx 1.30.1 commit 54b7945 onto pinned 1.27.1. Reachability: Reachable — charset_map can be reached via configuration-snippet annotations with proxy_buffering off.

Go Toolchain

  • CVE-2026-27145 — Go stdlib crypto/x509: Inefficient candidate hostname parsing leads to excessive CPU on crafted certificate chains. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — controller reads only its own client certs and the API server CA.
  • CVE-2026-42504 — Go stdlib: Govulncheck-flagged stdlib advisory, fixed in 1.26.4. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — covered by Go toolchain bump alongside CVE-2026-27145.
  • CVE-2026-42507 — Go stdlib: Govulncheck-flagged stdlib advisory, fixed in 1.26.4. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — covered by Go toolchain bump alongside CVE-2026-27145.
  • GO-2026-5038 (High, CVSS 7.5) — Go stdlib net/mail: Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — controller does not parse external MIME headers.
  • GO-2026-5039 — Go stdlib: Govulncheck-flagged stdlib advisory, fixed in 1.26.4. Fixed by Go 1.26.3 → 1.26.4. Reachability: Low — covered by Go toolchain bump.

Go Module Dependencies

  • CVE-2026-39833 — golang.org/x/crypto: Key constraints not enforced in golang.org/x/crypto/ssh/agent. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — ingress controller does not act as an SSH agent; crypto/ssh/agent reachable only via transitive imports.
  • CVE-2026-39832 — golang.org/x/crypto: Agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller does not forward SSH keys.
  • CVE-2026-46597 — golang.org/x/crypto: Byte arithmetic underflow causes panic in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
  • CVE-2026-39828 — golang.org/x/crypto: Bypass of certificate restrictions in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
  • CVE-2026-39835 — golang.org/x/crypto: Server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server.
  • CVE-2026-39827 — golang.org/x/crypto: Memory leak when rejecting channels → DoS in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
  • CVE-2026-39830 — golang.org/x/crypto: Client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server.
  • CVE-2026-39829 — golang.org/x/crypto: Pathological RSA/DSA parameters → DoS in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
  • CVE-2026-39831 — golang.org/x/crypto: Bypass of FIDO/U2F security-keys physical-interaction in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Not reachable — controller does not perform interactive SSH auth.
  • CVE-2026-39834 — golang.org/x/crypto: Infinite loop on large channel writes in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server/client.
  • CVE-2026-42508 — golang.org/x/crypto: Auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Not reachable — controller does not use knownhosts.
  • CVE-2026-46595 — golang.org/x/crypto: VerifiedPublicKeyCallback permissions skipped in golang.org/x/crypto/ssh. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller is not an SSH server.
  • CVE-2026-46598 — golang.org/x/crypto: Pathological inputs can panic client in golang.org/x/crypto/ssh/agent. Fixed by golang.org/x/crypto v0.50.0 → v0.52.0. Reachability: Low — controller does not act as an SSH agent client.
  • CVE-2026-39824 — golang.org/x/sys: Integer overflow in NewNTUnicodeString in golang.org/x/sys/windows. Fixed by golang.org/x/sys v0.43.0 → v0.45.0. Reachability: Not reachable — controller runs on Linux only.
  • CVE-2026-42506 — golang.org/x/net: Incorrect handling of namespaced elements in foreign content in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework (httpexpect).
  • CVE-2026-39821 — golang.org/x/net: Failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — idna.ToASCII reachable only from test/e2e framework.
  • CVE-2026-42502 — golang.org/x/net: Incorrect handling of HTML elements in foreign content in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.
  • CVE-2026-25680 — golang.org/x/net: Denial of service when parsing arbitrary HTML in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.
  • CVE-2026-25681 — golang.org/x/net: Incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.
  • CVE-2026-27136 — golang.org/x/net: Duplicate attributes can cause XSS in golang.org/x/net/html. Fixed by golang.org/x/net v0.53.0 → v0.55.0. Reachability: Low — net/html reachable only via test/e2e framework.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

1.15.4 (NES) - May 18, 2026

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.4

Helm Chart: HeroDevs/ingress-nginx --version 0.0.7 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.3 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.4)

This release backports the fix for CVE-2026-42945 ("NGINX Rift", CVSS 9.2, actively exploited in the wild) into the pinned NGINX 1.27.1 baseline. The NGINX base image rebuild also picks up Alpine 3.23.4 with newer curl/libcurl (8.19.0-r0), clearing five medium-severity curl CVEs along the way.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

NGINX

  • CVE-2026-42945 (Critical, CVSS 9.2) — "NGINX Rift" — heap buffer overrun in ngx_http_script_regex_end_code (the ngx_http_rewrite_module script engine). A rewrite whose replacement contains args sets is_args and never clears it; subsequent set/if evaluations then apply URL-escaping to captures and the destination buffer is allocated without accounting for the escape expansion. Active in-the-wild exploitation confirmed by VulnCheck. DoS (worker crash) readily reachable; RCE requires ASLR disabled. Patch: NES backport of upstream commit 2046b45a (fixed in nginx 1.31.0 mainline / 1.30.1 stable, released 2026-05-13) onto pinned 1.27.1. Reachability: the vulnerable code path is on the hot path for nearly every deployment because rewrite-target, canary routing, and X-Forwarded-* handling all generate the trigger pattern.

Alpine Packages

  • CVE-2025-14524 (Medium, CVSS 6.5) — curl/libcurl: OAuth2 bearer tokens leaked when an HTTP(S) request cross-protocol redirects to IMAP/LDAP/POP3/SMTP schemes. Fixed by rebuilding the NGINX base image (v2.2.9-nes.2 → v2.2.10-nes.1, Alpine 3.23.3 → 3.23.4, curl/libcurl 8.17.0-r1 → 8.19.0-r0). Not reachable — controller's curl usage is the OpenTelemetry C++ exporter only.
  • CVE-2025-14819 (Medium, CVSS 6.8) — curl/libcurl: libcurl accidentally reuses a CA store cached in memory with the partial-chain option reversed, potentially accepting untrusted TLS certificates on subsequent connections with altered SSL settings. Fixed by the same rebuild. Not reachable — OTel exporter uses a single static TLS config.
  • CVE-2026-1965 (Medium, CVSS 6.8) — curl/libcurl: libcurl incorrectly reuses authenticated connections with different credentials. Fixed by the same rebuild. Not reachable — OTel exporter uses a single static identity.
  • CVE-2026-3784 (Medium, CVSS 6.5) — curl/libcurl: HTTP proxy connection reuse with mismatched credentials allows authentication bypass. Fixed by the same rebuild (applied to both nginx-base and controller images). Not reachable — neither image routes user traffic through an HTTP proxy via curl.
  • CVE-2026-3805 (Medium, CVSS 6.3) — curl/libcurl: use-after-free in SMB request handling. Fixed by the same rebuild. Not reachable — controller does not use curl's SMB protocol support.

1.15.3 (NES) - May 4, 2026

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.3

Helm Chart: HeroDevs/ingress-nginx --version 0.0.5 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.3 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.3)

This release addresses CVE-2026-27135 in the nghttp2-libs Alpine package, four Go standard library advisories patched by upgrading the Go toolchain to 1.26.3, and an HTTP/2 transport vulnerability in golang.org/x/net patched by bumping that module to v0.53.0.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Alpine Packages

  • CVE-2026-27135 (High, CVSS 7.5) — nghttp2-libs: Denial-of-service via malformed HTTP/2 frames after session termination. Fixed by rebuilding the NGINX base image with nghttp2-libs 1.68.1-r0 (v2.2.9-nes.2 NGINX base respin).

Go Toolchain

  • GO-2026-4982 — html/template: Bypass of meta content URL escaping causes XSS. Fixed by upgrading Go 1.26.2 → 1.26.3.
  • GO-2026-4980 — html/template: Escaper bypass leads to XSS. Fixed by upgrading Go 1.26.2 → 1.26.3.
  • GO-2026-4971 — net: Panic in Dial and LookupPort when handling NUL byte on Windows. Fixed by upgrading Go 1.26.2 → 1.26.3. Not reachable in this build (controller runs on Linux only).
  • GO-2026-4918 — net/http and golang.org/x/net: Infinite loop in HTTP/2 transport on bad SETTINGS_MAX_FRAME_SIZE. Fixed by upgrading Go 1.26.2 → 1.26.3 and golang.org/x/net v0.52.0 → v0.53.0.

1.15.2 (NES) - April 20, 2026

Container Image: registry.nes.herodevs.com/nes/ingress-nginx:v1.15.1-nes-1.15.2

Helm Chart: HeroDevs/ingress-nginx --version 0.0.2 (see Helm Charts)

Based on upstream ingress-nginx v1.15.1 Go version: 1.26.2 NGINX version: 1.27.1 (compiled from source on Alpine 3.23.3)

This release addresses multiple high-severity CVEs across the Go toolchain and Go module dependencies.

For upgrade instructions using the NES for Ingress NGINX Helm chart, see Helm Charts.

Go Toolchain

  • CVE-2026-32282 — (Medium, CVSS 6.4) — Root.Chmod follows symlinks outside root via TOCTOU race on Linux (internal/syscall/unix). Fixed by upgrading Go 1.26.1 → 1.26.2.

Go Module Dependencies

  • CVE-2024-44337 (Medium, CVSS 5.1) — github.com/gomarkdown/markdown: Infinite loop in paragraph parser causes denial-of-service. Bumped to patched version.
  • CVE-2026-35204 (High, CVSS 8.4) — helm.sh/helm/v4: Path traversal in plugin version field allows arbitrary file write (CWE-22). Upgraded helm v4.1.3 → v4.1.4.
  • CVE-2026-35205 (High, CVSS 8.4) — helm.sh/helm/v4: Missing .prov file check skips plugin signature verification, enabling arbitrary code execution (CWE-636). Upgraded helm v4.1.3 → v4.1.4.
  • CVE-2026-40890 (High, CVSS 7.5) — github.com/gomarkdown/markdown: Out-of-bounds read/panic in SmartypantsRenderer on malformed < input. Bumped to patched version.