nginx 1.18.0 vulnerabilities: a banner triage guide

02Why a 1.18.0 banner is usually already patched

Debian and Ubuntu follow a stable-release policy: within a release they do not jump to a new upstream version, they backport the security fix into the existing one. So Ubuntu 22.04 ships nginx as 1.18.0-6ubuntu14.N and Debian 11 as 1.18.0-6.1+deb11uN, with the trailing number rising every time a fix lands. The headline 1.18.0 never changes, which is exactly what confuses version-based scanners.

That is why hiding the banner with server_tokens off reduces scanner noise but changes nothing about your actual exposure. The useful move is the opposite: read the package changelog to see which CVEs your build has fixed. An Ubuntu 22.04 box that applies security updates is clear of all but the two newest findings a scanner lists against 1.18.0, even though the version string is unchanged; a free Debian 11 install is missing five, as the table below shows. For the same pattern on the application layer, compare the distro-backport logic on the PHP2Shell page.

03How do I check my real patch level?

Compare the full package version, not the banner, against the fixes you care about, and confirm from the changelog. The commands below are for Debian and Ubuntu.

# the banner version: only the distro base version
nginx -v

# the real patch level: the full package version with the distro suffix
dpkg -l nginx nginx-common | grep '^ii'

# did the distro backport a specific fix into the INSTALLED build?
zcat /usr/share/doc/nginx/changelog.Debian.gz | grep -m1 CVE-2026-42945
# (apt changelog nginx shows the candidate version, not the installed one)

# stop advertising the version at all (add to the http { } block):
#   server_tokens off;

04Triage: the CVEs that affect 1.18.0

Every current nginx advisory whose vulnerable range includes 1.18.0 is listed below, with the configuration it needs, the first upstream release that fixes it, and the backport status on Ubuntu 22.04 (jammy) and Debian 11 (bullseye). Most entries need a module or directive that is not in a default build, so read the precondition before assuming a finding applies.

Scanners also report IDs that are not on the nginx.org list. CVE-2020-12440, often shown against 1.18.0, was rejected by its CNA as not a security issue. Ubuntu marks its nginx packages on 20.04, 22.04 and 24.04 as not affected by HTTP/2 Rapid Reset, CVE-2023-44487. Those findings can be closed with that evidence rather than a patch.

05Which findings actually need non-default config?

The table shows that almost none of these are reachable on a plain reverse proxy. Several need a man-in-the-middle position on an upstream connection (the scgi, uwsgi, SSI and TLS-upstream injection bugs), which is a much higher bar than sending a crafted request. Several need the mp4 module and a served MP4 file. The dav, slice, charset and mail entries each need their respective module and directive, and the resolver bug needs forged DNS responses.

The ones to check first are the rewrite, map and alias bugs: they appear in ordinary configs, and once the matching directive is present a crafted HTTP request is all they need. If your config uses rewrite with captures, prioritise NGINX Rift, CVE-2026-42945 and CVE-2026-9256; if it uses map with regex, prioritise the map overflow, CVE-2026-42533; the alias-plus-rewrite overflow CVE-2026-15176 needs a $request_filename read as well. A quick audit of the merged config narrows the list fast.

nginx -T 2>/dev/null > /tmp/nginx-full.conf

grep -nE '(^|[{;])\s*(mp4|slice|ssi|aio|dav_methods|grpc_pass|scgi_pass|uwsgi_pass|resolver|charset|source_charset|proxy_buffering|mail|smtp_auth)\b' \
     /tmp/nginx-full.conf

# rewrite, map and alias: the shapes behind the request-reachable overflows
grep -nE '(^|[{;])\s*(rewrite|map|alias)\b' /tmp/nginx-full.conf

06Debian 11 and Ubuntu 22.04 support status

The two platforms are not in the same place. Ubuntu 22.04 LTS is in standard security maintenance until May 2027, so it still receives nginx security updates; as of 24 October 2026 the newest two advisories (CVE-2026-15176 and CVE-2026-97205) were still at needs-triage for it, while everything older was fixed at the build shown above. Ubuntu 20.04 and earlier are covered only through Ubuntu Pro (ESM).

Debian 11 bullseye left free long-term support on 31 August 2026. Debian LTS shipped fixes up to the 1.18.0-6.1+deb11u8 build (DLA-4660-1), but the three July 2026 advisories (CVE-2026-42533, -56434 and -60005) were not released for bullseye before the cut-off. They arrived on 26 September 2026 as 1.18.0-6.1+deb11u9 (ELA-1832-1) through Freexian's Extended LTS, a paid subscription with a private repository, so a free Debian 11 install does not get them. The October advisories are not fixed for bullseye at all yet, even in ELTS. If you run Debian 11 on the public internet, the practical answer is to move to Debian 12 or 13 rather than to chase individual backports.

07What a reverse proxy can and cannot do

If the 1.18.0 in question is the server that terminates requests, these are bugs in its own request processing, so a filter running inside that same nginx cannot be relied on to stop them. The fix is to update the package, or to move off an end-of-life release. A separate, patched tier in front reduces exposure and absorbs flood and scan traffic in the way any reverse proxy shields an origin, but it does not turn an unpatched origin into a safe one.

Two practical habits help more than hiding the banner. Keep the distribution's nginx package updated, since that is where the 1.18.0 backports arrive, and audit the config so you know which of these CVEs could even apply; the nginx DDoS hardening guide covers the limits and timeouts worth setting on the origin itself. A web application firewall adds defence in depth and, once the origin only accepts proxy traffic, keeps it off the open internet, which also blunts the version scanners that flagged you in the first place; combine it with keeping the real address private, as in how to hide your origin IP.

08When should I actually upgrade or rebuild?

• Your 1.18.0 is a hand-built upstream binary: upgrade now to current stable (1.30.x) or mainline (1.31.x), because the upstream 1.18 branch is end of life and gets no fixes
• Your config uses rewrite with captures or map with regex: patch the request-reachable overflows first (CVE-2026-42945, CVE-2026-9256, CVE-2026-42533, CVE-2026-15176)
• You run Debian 11 on the public internet: plan a move to Debian 12 or 13, since free LTS ended on 31 August 2026 and newer nginx fixes are paid ELTS only or not yet available
• You run Ubuntu 22.04: keep applying security updates and watch for the two pending advisories to be released
• In every case, judge by the full package version and its changelog, not the nginx/1.18.0 banner