🛡️ MGASA-2026-0301 — nginx

Updated nginx packages fix security vulnerabilities

CVE-2026-42533:

Heap buffer overflow might occur in a worker process when using the map

directive with regex matching if the map variable was included in a

string expression after a capture affected by this map; a similar issue

might happen when using a non-cacheable variable in a

string expression.

Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

.

CVE-2026-60005:

Uninitialized memory access might occur when using unnamed regex

captures with the "slice" directive or background cache update, which

could result in worker process memory disclosure or worker process

termination.

.

CVE-2026-56434:

Use-after-free might occur when processing a specially crafted proxied

backend response with the ngx_http_ssi_filter_module.

Thanks to P4P3R-HAK.