| Package | nginx |
|---|---|
| Version | 1.14.2-2+deb10u9 (buster) |
| Related CVEs | CVE-2026-42533 CVE-2026-56434 |
Multiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service or potentially the execution of arbitrary code.
CVE-2026-42533
A heap buffer overflow was discovered in the nginx script engine. It
can be triggered when a map directive performs regular expression
matching and a string expression references captures modified by the
map, or when non-cacheable variables change between the script length
pass and the script copy pass.
CVE-2026-56434
Duplicate finalization of an HTTP subrequest can result in a
use-after-free. The issue is observable in configurations using
server-side includes together with proxy_pass and proxy_buffering
disabled, when an upstream response causes the same subrequest to be
posted twice.
For Debian 10 buster, these problems have been fixed in version 1.14.2-2+deb10u9.
We recommend that you upgrade your nginx packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.