Update your nginx instances
cross-posted from: https://lemmy.world/post/46851448
- Affected an non-affected versions https://nginx.org/en/security_advisories.html
- CVE record https://www.cve.org/CVERecord?id=CVE-2026-42945
- CVE details https://nvd.nist.gov/vuln/detail/CVE-2026-42945
- PoC https://github.com/DepthFirstDisclosures/Nginx-Rift
CVE - Common Vulnerabilities and Exposures system
RCE - Remote Code Execution
PoC - Proof of Concept
It’s days like this where I’m happy I’m unemployed. I have a group chat with a few friends and they’re pushing out patches and it’s a bit of a rush.
All my publicly accessible servers update every 6 hours and reboot after whenever they need to. It’s rare I need to step in and fix something. I checked a few hours ago and I’m not at risk.
All my publicly accessible servers update every 6 hours and reboot after whenever they need to. It’s rare I need to step in and fix something. I checked a few hours ago and I’m not at risk.
not the flex you think it is.
didn’t npm have a worm problem a few days ago?
Yep. I wasn’t affected thankfully. Didn’t realise I was flexing, sorry. Just happy most of my stack is automated and it’s quite low maintenance at this point.
Where do I draw the line then? Serious question. If updating every couple hours is bad, then what’s safe?
for corporate services we do every 30 days. which is standard. emergency patches get direct support and resolved quickly.
idk, also it is not about the frequency you update, it is usually about how long has it been since package is published to the internet
see concept of min release age https://pnpm.io/blog/releases/10.16
i wonder if other package manager have similar thing or not
For anyone else using SWAG, it looks like a fix is on its way but not available yet. This SWAG issue points to an upstream Alpine package dependency that needs to be updated first. Looking at the source, they just recently committed backported patches, so presumably a new version will be released soon; then the SWAG image can be updated.
I have an old Debian 11 “bullseye” installation running on one of my servers. It’s stuck at nginx 1.18.0, but it should theoretically still be covered by Debian 11 LTS security updates, right? https://wiki.debian.org/LTS/Using
nginx/oldoldstable-security,now 1.18.0-6.1+deb11u5
