CVE-2026-42946: NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability
A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-read of data. When scgipass or uwsgipass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Other sources
NGINX ngxhttpscgimodule and ngxhttpuwsgimodule vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6Fixed in 1.30.1-3 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-3 - Configuration
Remove or comment out scgi_pass directives in your nginx configuration (e.g., nginx.conf/sites-available) so that scgi_pass is not configured if it is not required.
NGINX (ngx_http_scgi_module) scgi_pass = disabled - Configuration
Remove or comment out uwsgi_pass directives in your nginx configuration (e.g., nginx.conf/sites-available) so that uwsgi_pass is not configured if it is not required.
NGINX (ngx_http_uwsgi_module) uwsgi_pass = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42946?
The severity of CVE-2026-42946 is considered high due to the potential for excessive memory allocation and data over-read vulnerabilities.
How do I fix CVE-2026-42946?
To fix CVE-2026-42946, you should update to the latest stable release of NGINX that addresses the vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module.
Which NGINX versions are affected by CVE-2026-42946?
CVE-2026-42946 potentially affects all versions of NGINX that include ngx_http_scgi_module and ngx_http_uwsgi_module.
What are the potential impacts of CVE-2026-42946?
The potential impacts of CVE-2026-42946 include service disruption and memory exhaustion that may lead to Denial of Service.
Is authentication required for exploiting CVE-2026-42946?
No, CVE-2026-42946 can be exploited by unauthenticated attackers when scgi_pass or uwsgi_pass is configured.