Iipatches zeNginx 1.31.1 kunye ne-1.30.2 zikhutshiwe, zilungisa ubuthathaka obubalulekileyo (CVE-2026-9256) obuvumela ukuphunyezwa kwekhowudi ekude ngamalungelo enkqubo yomsebenzi weNginx ngokuthumela isicelo se-HTTP esenziwe ngokukodwa. Abaphandi abafumene le ngxaki babonise i-exploit esebenzayo, eya kupapashwa kunye nenkcazo epheleleyo kwiintsuku ezingama-30 emva kokuba ipatch ikhutshiwe. Ubuthathaka bunikwe ikhowudi ethi nginx-poolslip. Le ngxaki izibonakalisa iqala ngenguqulo yeNginx 0.1.17. Ngexesha lokubhala, akukho patches zipapashiweyo ze-Angie kunye neFreenginx.
Njengomcimbi ofanayo olungisiweyo kwiveki ephelileyo, olu buthathaka butsha lubangelwa kukugcwala kwe-buffer kwimodyuli ye-ngx_http_rewrite_module kwaye lubonakala kwiindlela zokumisela ezineentetho ezithile eziqhelekileyo kwisikhokelo "sokubhala ngokutsha". Kule meko, ubuthathaka buchaphazela iinkqubo ezineepateni zokutshintshana ezigqithanayo (iibhrakhethi ngaphakathi kweebhrakhethi) kwintetho yokubhala ngokutsha, efana "^/((.*))$" okanye "^/(test([123]))$", kunye nokusetyenziswa kokutshintshwa okuninzi okungachazwanga kumtya wokutshintsha (umz., "$1$2").
Kwakhona okuphawulekayo kukukhululwa kwe-njs 0.9.9, imodyuli yokudibanisa abatoliki beJavaScript kwiseva ye-nginx HTTP. Le nguqulelo intsha ilungisa ubuthathaka (CVE-2026-8711) obukho ukususela kwi-njs 0.9.4. Le ngxaki ibangelwa kukugcwala kwe-buffer kwaye izibonakalisa kwiindlela ezicwangcisiweyo nge-js_fetch_proxy directive, equlethe ii-variables ze-nginx kunye nedatha evela kwisicelo somthengi (njenge-$http_*, $arg_*, kunye ne-$cookie_*), kunye nokusetyenziswa kwe-location handler ebiza umsebenzi we-ngx.fetch(). Ubuthathaka bunokusetyenziswa ukwenza ikhowudi kunye namalungelo enkqubo yomsebenzi we-nginx ngokuthumela isicelo se-HTTP esenziwe ngokukodwa.
umthombo: opennet.ru
