UnratedFix available
Fix CVE(s): CVE-2026-42533
Type: advisorySources: OSV
* SECURITY UPDATE: heap buffer overflow in the script engine when a map regex capture or a non-cacheable variable changes length between the length and copy passes of a string expression - debian/patches/CVE-2026-42533.patch: add buffer end checks to the http and stream script copy codes, the access logs and the direct script users in the proxy, fastcgi, scgi, uwsgi, grpc, index and try_files modules, and cut the result to its actual length - debian/modules/patches/http-ndk/CVE-2026-42533-ndk.patch: emit the new complex value end code in the bundled NDK, which keeps its own copy of the rewrite value compiler - debian/modules/patches/nchan/CVE-2026-42533-nchan.patch: bounds check the script copy codes run by the bundled nchan module - CVE-2026-42533 * IMPORTANT: the layout of the script engine structures changed (an end pointer was added to ngx_http_script_engine_t and ngx_stream_script_engine_t, and a status field to the stream one), and complex values compiled for the rewrite engine now need the new ngx_http_script_complex_value_end_code. Third-party dynamic modules that drive the nginx script engine directly must be rebuilt against this version and updated, otherwise they cause memory corruption and worker crashes. This affects NDK based modules such as set-misc, array-var, encrypted-session, form-input and the set_by_lua directive of the lua module. The bundled NDK has been adapted.
- Products
- libnginx-mod-http-auth-pam, libnginx-mod-http-cache-purge, libnginx-mod-http-dav-ext, libnginx-mod-http-echo, libnginx-mod-http-fancyindex, libnginx-mod-http-geoip, libnginx-mod-http-headers-more-filter, libnginx-mod-http-image-filter, libnginx-mod-http-lua, libnginx-mod-http-ndk, libnginx-mod-http-perl, libnginx-mod-http-subs-filter, libnginx-mod-http-uploadprogress, libnginx-mod-http-upstream-fair, libnginx-mod-http-xslt-filter, libnginx-mod-mail, libnginx-mod-nchan, libnginx-mod-rtmp, libnginx-mod-stream, nginx, nginx-common, nginx-doc, nginx-extras, nginx-full, nginx-light
- Affected versions
- Not specified
- Fixed versions
- 1.14.2-2+deb10u5+tuxcare.els8
- CVEs
- CVE-2026-42533
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:22 UTC · Revision 1
Source evidence
* SECURITY UPDATE: heap buffer overflow in the script engine when a map regex capture or a non-cacheable variable changes length between the length and copy passes of a string expression - debian/patches/CVE-2026-42533.patch: add buffer end checks to the http and stream script copy codes, the access logs and the direct script users in the proxy, fastcgi, scgi, uwsgi, grpc, index and try_files modules, and cut the result to its actual length - debian/modules/patches/http-ndk/CVE-2026-42533-ndk.patch: emit the new complex value end code in the bundled NDK, which keeps its own copy of the rewrite value compiler - debian/modules/patches/nchan/CVE-2026-42533-nchan.patch: bounds check the script copy codes run by the bundled nchan module - CVE-2026-42533 * IMPORTANT: the layout of the script engine structures changed (an end pointer was added to ngx_http_script_engine_t and ngx_stream_script_engine_t, and a status field to the stream one), and complex values compiled for the rewrite engine now need the new ngx_http_script_complex_value_end_code. Third-party dynamic modules that drive the nginx script engine directly must be rebuilt against this version and updated, otherwise they cause memory corruption and worker crashes. This affects NDK based modules such as set-misc, array-var, encrypted-session, form-input and the set_by_lua directive of the lua module. The bundled NDK has been adapted.
osv:CLSA-2026-1791276939
libnginx-mod-http-auth-pam
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-cache-purge
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-dav-ext
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-echo
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-fancyindex
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-geoip
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-headers-more-filter
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-image-filter
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-lua
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-ndk
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-perl
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-subs-filter
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-uploadprogress
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-upstream-fair
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-http-xslt-filter
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-mail
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-nchan
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-rtmp
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
libnginx-mod-stream
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
nginx
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
nginx-common
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
nginx-doc
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
nginx-extras
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
nginx-full
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
nginx-light
Fixed versions: 1.14.2-2+deb10u5+tuxcare.els8
Complete source record
{
"id": "fe0fb8e62dda459bed6ee85523bb73ee87f50bef5638c4b9859090dc9aa3f9af",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791276939",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2026-42533",
"summary": "* SECURITY UPDATE: heap buffer overflow in the script engine when a map regex capture or a non-cacheable variable changes length between the length and copy passes of a string expression - debian/patches/CVE-2026-42533.patch: add buffer end checks to the http and stream script copy codes, the access logs and the direct script users in the proxy, fastcgi, scgi, uwsgi, grpc, index and try_files modules, and cut the result to its actual length - debian/modules/patches/http-ndk/CVE-2026-42533-ndk.patch: emit the new complex value end code in the bundled NDK, which keeps its own copy of the rewrite value compiler - debian/modules/patches/nchan/CVE-2026-42533-nchan.patch: bounds check the script copy codes run by the bundled nchan module - CVE-2026-42533 * IMPORTANT: the layout of the script engine structures changed (an end pointer was added to ngx_http_script_engine_t and ngx_stream_script_engine_t, and a status field to the stream one), and complex values compiled for the rewrite engine now need the new ngx_http_script_complex_value_end_code. Third-party dynamic modules that drive the nginx script engine directly must be rebuilt against this version and updated, otherwise they cause memory corruption and worker crashes. This affects NDK based modules such as set-misc, array-var, encrypted-session, form-input and the set_by_lua directive of the lua module. The bundled NDK has been adapted.",
"evidence": "osv:CLSA-2026-1791276939",
"products": [
{
"name": {
"value": "libnginx-mod-http-auth-pam",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-cache-purge",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-dav-ext",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-echo",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-fancyindex",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-geoip",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-headers-more-filter",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-image-filter",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-lua",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-ndk",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-perl",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-subs-filter",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-uploadprogress",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-upstream-fair",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-http-xslt-filter",
"evidence": "/affected/14/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/14/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-mail",
"evidence": "/affected/15/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/15/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-nchan",
"evidence": "/affected/16/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/16/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-rtmp",
"evidence": "/affected/17/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/17/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libnginx-mod-stream",
"evidence": "/affected/18/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/18/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nginx",
"evidence": "/affected/19/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/19/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nginx-common",
"evidence": "/affected/20/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/20/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nginx-doc",
"evidence": "/affected/21/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/21/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nginx-extras",
"evidence": "/affected/22/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/22/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nginx-full",
"evidence": "/affected/23/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/23/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nginx-light",
"evidence": "/affected/24/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.14.2-2+deb10u5+tuxcare.els8",
"evidence": "/affected/24/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791276939",
"aliases": [
"CLSA-2026-1791276939"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-auth-pam",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-auth-pam?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-cache-purge",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-cache-purge?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-dav-ext",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-dav-ext?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-echo",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-echo?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-fancyindex",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-fancyindex?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-geoip",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-geoip?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-headers-more-filter",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-headers-more-filter?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-image-filter",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-image-filter?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-lua",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-lua?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-ndk",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-ndk?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-perl",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-perl?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-subs-filter",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-subs-filter?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-uploadprogress",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-uploadprogress?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-upstream-fair",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-upstream-fair?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-http-xslt-filter",
"purl": "pkg:deb/tuxcare/libnginx-mod-http-xslt-filter?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-mail",
"purl": "pkg:deb/tuxcare/libnginx-mod-mail?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-nchan",
"purl": "pkg:deb/tuxcare/libnginx-mod-nchan?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-rtmp",
"purl": "pkg:deb/tuxcare/libnginx-mod-rtmp?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "libnginx-mod-stream",
"purl": "pkg:deb/tuxcare/libnginx-mod-stream?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "nginx",
"purl": "pkg:deb/tuxcare/nginx?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "nginx-common",
"purl": "pkg:deb/tuxcare/nginx-common?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "nginx-doc",
"purl": "pkg:deb/tuxcare/nginx-doc?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "nginx-extras",
"purl": "pkg:deb/tuxcare/nginx-extras?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "nginx-full",
"purl": "pkg:deb/tuxcare/nginx-full?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.2-2+deb10u5+tuxcare.els8"
}
]
}
],
"package": {
"name": "nginx-light",
"purl": "pkg:deb/tuxcare/nginx-light?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791276939.json"
}
}
],
"modified": "2026-10-26T09:31:53.124454626Z",
"provider": "osv",
"upstream": [
"CVE-2026-42533"
],
"references": [
"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1791276939.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-42533"
]
},
"related_cves": [
{
"value": "CVE-2026-42533",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448827,
"published_at": "2026-10-06T08:55:50+00:00"
}